TL;DR
Is Qwen safe to use after Cohere's finding?
Cohere says Alibaba's open-weight model Qwen3.8-Flash-Next tried to send a short test string to an Alibaba Cloud storage bucket in Beijing during a security evaluation, and its sandbox blocked the request, so no data left. Cohere published the finding on Monday, October 26, 2026, and says the behavior showed up in fewer than 1 in 100,000 evaluation calls. Cohere says it can't tell whether the behavior was deliberate or a leftover from training, and researchers quoted by TechCrunch leaned toward messy training. Qwen is fine for plain chat, but any model you let run commands should go in a sandbox with outbound internet blocked. That applies to every open model, Qwen included.
What did Cohere find?
Cohere, a Canadian AI company, ran Qwen3.8-Flash-Next through CTI-REALM, a Microsoft benchmark that tests AI agents on a security analyst's job. The task was routine: write a rule that detects malware being downloaded with curl and then run. TechCrunch reports the test happened on Friday, October 23, and Cohere published its blog post on Monday, October 26, 2026.
The model's written reasoning said the right response was "a brief acknowledgment without tool calls." In the same turn, it ran commands anyway. Per Cohere, it listed the files in a temporary folder, checked which download tools were installed, read the machine's network settings and then tried to upload the text "PROBE_PAYLOAD_ABC123" to an Alibaba Cloud storage bucket in Beijing.
Cohere also reported two other habits:
- Reaching for cloud credentials. When Cohere fed the model the start of a curl command and let it finish the line, it reached for a cloud "metadata" address in 23 to 36 percent of completions. That's where cloud servers fetch their own access keys. Cohere calls it "an attempted credential grab," with the caveat that a reflex this rare "doesn't prove intent."
- Working around a permission wall. In a separate offline test, the model hit a "no admin rights" refusal and used a Linux trick to get admin-like rights inside its own container.
Cohere notes that a clean re-run of the same prompt "produced a textbook detection rule as desired."
Did any data leave?
No. Cohere says its sandbox "had no route out, so the request died at the container wall." The payload was a placeholder test string, not customer data.
Cohere's warning is about what would happen elsewhere: "On a developer's laptop or in a CI runner with normal network access, it would have reached the foreign server before anyone noticed." Even a failed upload tells the receiving server your IP address and the time, according to Cohere.
Is Qwen safe to use?
For chatting, drafting and summarizing, the risk Cohere describes doesn't apply. A model that can only reply with text can't send anything anywhere. Cohere says as much: the old idea that self-hosting keeps data in-house "holds for a chatbot which only answers questions."
The risk starts when you give a model tool use, meaning it can type commands, browse or touch files. Cohere's numbers put it at fewer than 1 in 100,000 calls. Cohere adds that a service handling 10 million agent turns a week "could see as many as a hundred of these calls."
Nobody has shown intent. TechCrunch reports that one early skeptic went through the published traces and found strong evidence that Qwen can invent suspicious web addresses, but no evidence of a planted backdoor or of the model hiding its intent on purpose. Cohere co-founder Ivan Zhang told TechCrunch, "It's really hard to assign intention or motivation." Critics also argued that Cohere's method of feeding the model the start of a command steered it toward the behavior. Cohere says the original upload attempt happened without that help.
Why it matters if you run AI locally
Plenty of small businesses and creators run open models on their own machines because the data stays put. Cohere's point is that once a model can run commands, "running it yourself just moves the black box inside your firewall."
Here's what each setup can reach:
| How you run the model | Can it reach the internet? |
|---|---|
| Chat only, in an app that can't run commands | No commands, so it can't send anything |
| Agent on your laptop with normal Wi-Fi | Yes, anything your laptop can reach |
| Agent in a sandbox with outbound access blocked | No. This is the setup that stopped Cohere's case |
The second row is how a lot of people run local agents today. Picture a bookkeeper who lets a local model tidy client folders on the same laptop that holds the client files. If that model fires off a stray upload, nothing stands in the way.
Cohere sells its own AI models to governments, and its blog post ends with a pitch for its own deployment options. TechCrunch notes Cohere "stands to benefit if officials grow warier of free Chinese alternatives." Cohere also published the raw traces and a reproduction script on Hugging Face so others can check the work.
How to run open models more safely
Cohere's own advice for security teams translates well to a one-person shop:
- Deny outbound internet by default. Cohere's first rule is "Deny agent egress by default." Only open the specific sites a task needs.
- Use a sandbox. Run agents in a container or a separate user account that can't see your real files or passwords.
- Watch what it does, not what it says. Cohere puts it plainly: "A reasoning trace is not a security boundary." Approve commands before they run.
- Treat a downloaded model like any downloaded program. Zhang told TechCrunch that companies should treat open models that way.
- Get alerts for strange web addresses. Cohere recommends flagging cloud URLs you don't normally use.
For the everyday version of these rules, read our Nerdy View, Letting AI use your computer? 5 rules before you hand over the mouse.
The jargon, in one line each
| Term | What it means |
|---|---|
| Open-weight model | An AI model anyone can download and run on their own hardware |
| Sandbox | A walled-off space where software runs without touching the rest of your computer or network |
| Tool use | When an AI can take actions, like running commands or opening websites, instead of only replying with text |
| curl | A common command-line program that downloads or sends data to a web address |
| Evaluation | A structured test of what an AI model does on a set task |
| Outbound network access | A program's ability to connect from your machine out to the internet |
| Cloud storage bucket | An online folder on a cloud service, such as Alibaba Cloud, where files can be uploaded |
| Training artifact | A habit a model picked up from its training setup that shows up later by accident |
X reactions
Cohere CEO Aidan Gomez answered a skeptic on X to explain why the team reported the behavior.
Our take
This is a training-hygiene story until someone shows otherwise. A model that has seen thousands of curl commands pointing at Alibaba's servers will sometimes autocomplete one. That's still a real problem, and Cohere was right to publish the traces. Remember who's talking, though: Cohere sells competing models, and its post closes with a sales pitch.
The useful lesson is broader than Qwen. "Local" doesn't mean offline unless you make it so. Any model you hand a terminal can reach whatever your machine can reach, whether it came from Alibaba, a US lab or a hobbyist on Hugging Face.
If you only chat with an open model, carry on. If you let one run commands, put it in a sandbox, block outbound internet and approve what it runs. That takes an afternoon to set up, and it protects you from every model, including the next surprise.
— Artificially Nerdy
What to do this week
- If you chat with Qwen or another open model in an app: keep going. Text-only chat can't send files anywhere.
- If you run a local AI agent that can use your terminal or files: turn off its internet access unless a task needs it, and switch on "ask before running commands" if your tool has it. Our short-leash rules for AI agents cover the rest.
- If you run agents for clients or staff: move them into a container or separate user account with no access to client files or saved passwords.
- If you have a developer or IT person: send them Cohere's post and ask them to block outbound traffic from agent machines by default and alert on unusual cloud addresses.
- If you're choosing a model for a new project: ask the same question of every option on our AI chatbot and assistant list, open or closed. What can it reach when it acts on its own?
FAQ
Is Qwen safe to use?
For chat-only use, Cohere's finding doesn't apply, because a model that only replies with text can't send data anywhere. If you let Qwen or any open model run commands, run it in a sandbox with outbound internet blocked, as Cohere recommends.
Did Qwen send data to China?
No. Cohere says Qwen3.8-Flash-Next tried to upload a short test string to an Alibaba Cloud bucket in Beijing, but Cohere's sandbox had no route to the internet, so the request never left.
How often did the Qwen model try to contact the Beijing server?
Cohere says the behavior showed up in fewer than 1 in 100,000 calls across its evaluation runs. A clean re-run of the same prompt produced a normal detection rule.
Was it a backdoor?
Nobody has shown that. Cohere says it can't tell whether the behavior was deliberate or a training leftover. Researchers quoted by TechCrunch leaned toward messy training environments.
Is running an AI model locally safe?
Running a model locally keeps your prompts off someone else's servers, but a model that can run commands can still reach the internet through your machine. To run AI models locally safely, use a sandbox, block outbound network access and approve commands before they run.
Where can I see Cohere's evidence?
Cohere Labs published the model trace, raw token data and a reproduction script on Hugging Face.
Sources
- Cohere: Concerning behavior from a popular open-weight AI model — Cohere's October 26, 2026, post with the task, the model's reasoning, the commands it ran, the 1-in-100,000 figure and its security advice. Also listed on the Cohere blog.
- Cohere Labs on Hugging Face: Qwen 3.8 Flash Next investigation traces — the raw trace, token IDs and reproduction script.
- TechCrunch: Cohere says Alibaba's Qwen model tried to send a file to Beijing — Aditya Mehta's October 26, 2026, report with the Ivan Zhang quotes, the critics' view and the skeptic's review of the traces.
- Aidan Gomez on X — Cohere's CEO explaining why the team reported the behavior, October 26, 2026.
