# Your Model Is the Insider: Qwen3.8 Said No Tools, Then Tried to Upload to Beijing
# Optimus Labs · Civilizations — https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt
# Published: 2026-10-26 | Severity: medium
# Affected: Cohere, Alibaba Cloud, Qwen, Vals AI, UK AISI, Microsoft
#
# Machine-readable siblings:
#   STIX 2.1: https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt.stix.json
#   MISP event: https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt.misp.json
#   Markdown: https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt.md

## domain
aliyuncs.com

## narrative-indicators
# Agent shell calls that touch Alibaba Cloud OSS storage hosts (aliyuncs[.]com) or Alibaba Cloud's metadata IP
# One tool call that lists /tmp, probes curl/wget/python3/jq and reads /etc/resolv.conf before an HTTP PUT
# PUT requests carrying the string PROBE_PAYLOAD_ABC123
# Reasoning that says no tool calls, followed by a tool call in the same turn