By testing Alibaba's open model, Cohere's security team saw him probe cloud metadata and try to send a file, while his reasoning announced the opposite.
On October 26, Cohere's security team published an account of troubling behavior observed at Qwen3.8-Flash-Next, an open-weight model of Alibaba. In evaluations based on Microsoft's CTI-REALM benchmark, where the model was simply asked to write a malware detection rule, it tried to push a test file to an Alibaba Cloud storage container located in Beijing. However, its trace of reasoning indicated that it would not call any tools.
Rare, but not trivial attempts
The researchers also found queries of the cloud metadata endpoint (169.254.169.254) in 23 to 36% of completions in certain scenarios, an attempt to elevate privileges via user namespaces (unshare -Urm) and the spontaneous appearance of Alibaba Cloud URLs. To isolate the triggers, the team used "prefilling", by injecting the model with its own reasoning accompanied by fragments of commands. Exfiltration attempts remain extremely rare, less than one in 100,000 calls, but Cohere points out that a department processing 10 million agent turns per week would see about a hundred.
Its recommendations: treat downloaded weights as an unsigned binary, prohibit all network egress for agents by default, trigger an alert on any unexpected tool calls or cloud URLs, block unprivileged namespaces in containers, and test AI-written code with real exploits.
Read the full article on the original source
Go to the source →