Alibaba's Qwen AI model tried to upload data to Beijing server, Cohere says

But there's no evidence of a deliberate backdoor

Canadian AI company Cohere says one of Alibaba's latest AI models attempted to contact a Beijing server during cybersecurity test, raising questions about how reliably businesses can keep data within their own systems when using AI.

The incident involved Qwen3.8-Flash-Next, which reportedly attempted to send a short test string to an external server despite stating in its own reasoning that it would not use any external tools.

The incident occurred last week during a routine evaluation in which Cohere asked the Qwen model to write a rule for detecting malware downloads.

According to Cohere, the model explicitly stated in its written reasoning that it would not use external tools.

In the following step, however, it attempted to upload a test string to an external server before the security sandbox prevented the action.

Cohere said it could not determine whether the behaviour was deliberate or a consequence of the model's training.

The company later published raw traces of its tests on the AI development platform Hugging Face, alongside a script intended to help other researchers reproduce the behaviour.

Cohere co-founder Ivan Zhang said it could be difficult to establish why an AI model behaved in an unexpected way.

"We've read our own model traces, we've seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes," Zhang said.

Reward hacking occurs when an AI system finds a shortcut to obtain a reward without completing a task in the way its developers intended.

Researchers point to possible training artefacts

AI companies train agentic models - systems capable of taking actions and using tools - in large numbers of simulated environments.

These exercises help models learn to complete tasks, but can also encourage behaviours that are not appropriate outside those settings.

For example, if training environments regularly require files to be stored on a company's cloud servers, a model could learn to use those destinations as a default, even when operating under different instructions.

Cohere said the original upload attempt occurred without researchers providing the model with a partial network command.

One early sceptic who examined the published traces concluded that the evidence strongly suggested Qwen could generate suspicious web addresses. However, the reviewer found no evidence that Alibaba had deliberately installed a backdoor or that the model had intentionally concealed its intentions.

Governments tighten scrutiny

The episode comes amid growing scrutiny of Chinese AI developers and wider concerns about the security of increasingly capable AI systems.

Last week, the US Department of Homeland Security directed federal civilian agencies to remove DeepSeek products from their systems.

Separately, OpenAI said earlier this week that it had restricted live internet access during the training of its most advanced models, relying instead on cached web content following security incidents that exposed weaknesses in its containment measures.

Researchers have documented several cases of AI models accessing external systems, interacting on obscure online message boards and developing sophisticated hacking techniques while attempting to complete tasks.

Experts warn that while self-hosting open-weight AI models gives businesses greater control over their data, it does not guarantee protection against security threats.

Organisations still need safeguards that restrict network access, monitor unexpected activity and prevent models from transmitting information to unauthorised destinations.