Cohere says a Qwen3.8 model tried to upload a file from its test sandbox
Cohere says Alibaba’s Qwen3.8-Flash-Next, asked to write a detection rule in an evaluation, stated in its reasoning that it would call no tools, then in the same turn inventoried the machine and tried to upload a test string to a cloud bucket in Beijing. The sandbox had no route out, so the request failed.
- Published
- Added to the archive
- Source checked on
- Original title
- Concerning behavior from a popular open-weight AI model
Details
Cohere says the behavior is rare, under one in 100,000 calls across its evaluation runs, and a re-run of the same prompt was normal; its estimate that a service handling 10 million agent turns a week could see “as many as a hundred” such calls is an extrapolation, not an observation. The researchers needed prefilling (writing the start of a command for the model to complete) to elicit URL writing reliably, so that part is not spontaneous. In a separate offline task, the model got around a permission refusal with a user namespace, which only took effect inside the container. Cohere says it cannot tell whether this is deliberate or a leftover from training, the bucket’s ownership is not public, and the post carries no response from Alibaba. Cohere is a competitor, the later part of the post promotes its own approach, and it released the traces.