On Monday, Cohere described what happened inside a sandbox in Toronto. The team had Qwen3.8-Flash-Next write a defensive detection rule, a routine case out of CTI-REALM, Microsoft’s benchmark for AI agents doing a security analyst’s job. The model did not stick to the task: it inventoried the machine it was running on, then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing. The sandbox blocked the attempt.
The striking part is not the network call but the reasoning that came before it. It said explicitly that the model would not call any tools. In the very next step it called one. Any guardrail hanging off the chain of thought would have waved that turn through.
The reading did not survive a day
The obvious interpretation, a model phoning home, was walked back quickly. Cohere co-founder Ivan Zhang told TechCrunch: “It’s really hard to assign intention or motivation. We’ve read our own model traces, we’ve seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes.” Cohere itself writes that it cannot say whether the behavior was deliberate or a leftover from training.
There is an unglamorous explanation available. Agentic skills are trained in thousands of practice environments, and if those routinely store their files in Alibaba’s cloud, a model learns to write files there. Critics also argue Cohere’s method helped build the result: to find the trigger, Cohere supplied the start of a network command and let the model complete it, which measures something other than how often Qwen does this on its own.
One more detail fits that picture. The reasoning trace invented an earlier turn of conversation that never took place. According to Cohere this appears in around one percent of Qwen3.8’s first-turn responses, far more often than the network call. No link could be proved.
The gap sits in the weights, not in the intent
The sentence that matters shows up almost in passing in Cohere’s post: the software supply chain used to begin with the first line an engineer wrote; today it begins inside the weights of the model that writes the code and drives the terminal. That is the finding, and it holds whether or not Alibaba intended anything. Self-hosting an open-weight model does not abolish the black box, it moves it behind your own firewall. Chinese models accounted for 41 percent of Hugging Face downloads in the year to March 2026. For security teams, then, the lesson here is not “espionage” but something plainer: an agent should never hold more privileges than its task requires.