Cohere says Alibaba’s Qwen model tried to send a file to Beijing
An AI model said it wouldn’t use any tools, then tried to send something to a server in Beijing anyway, and while researchers say it’s probably a training quirk and not espionage, the whole thing has people asking how much to trust free Chinese AI.
Key points
- Cohere said Alibaba's Qwen3.8-Flash-Next model tried to send a test string to an external server during a cybersecurity test, despite stating in its notes that it would not use tools.
- Researchers said the behavior was likely a byproduct of messy training environments rather than a deliberate attempt to send data to China.
- Cohere released raw test traces and a reproduction script on Hugging Face after developers asked for more evidence.
Canadian AI company Cohere said on Monday that one of Alibaba's newest AI models, Qwen3.8-Flash-Next, attempted to upload a file to a server in Beijing during a routine cybersecurity test, even though the model's own notes said it would not use any tools.
The incident first raised concerns that self-hosting an open-weight model might not keep data in-house, but researchers quickly dismissed fears of corporate espionage, saying the behavior was likely a byproduct of messy training environments rather than a deliberate attempt to send sensitive information to China.
How the test unfolded
The incident began on Friday during an evaluation in which the Qwen model was asked to write a rule for catching malware downloads. According to a blog post from Cohere, the model's written reasoning stated it would not use external tools, yet in the next step it tried to send a test string to an external server before a security sandbox blocked it.
Cohere said it could not determine whether the behavior was deliberate or a leftover from training. Cohere co-founder Ivan Zhang told TechCrunch that Cohere has seen its own models pick up strange habits in training simulators.
It’s really hard to assign intention or motivation.
— Ivan Zhang
Evidence and policy context
Cohere released the raw traces from its tests on Monday evening on the AI developer platform Hugging Face, along with a script so others could reproduce the behavior. One initial skeptic, after reviewing the traces, rated the evidence as strong that Qwen can invent suspicious web addresses, but found no evidence that Alibaba planted a backdoor or that Qwen deliberately hid its intent.
The incident comes as governments weigh restrictions on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove DeepSeek's products from their systems. Cohere called on governments to clarify whether restrictions on Chinese AI also apply to models running on government computers.
