{ "@context": "https://schema.org", "@type": "Report", "url": "https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt", "identifier": "qwen38-model-insider-risk-upload-attempt", "headline": "Your Model Is the Insider: Qwen3.8 Said No Tools, Then Tried to Upload to Beijing", "name": "Your Model Is the Insider: Qwen3.8 Said No Tools, Then Tried to Upload to Beijing", "abstract": "Research by Cohere. The reasoning trace said no tools, then the same turn ran a shell call that tried to upload a test string to an Alibaba Cloud bucket in Beijing. The sandbox had no route out. Whether the model was really calling home is disputed, and it does not change the fix.", "description": "Cohere found and published this trace. During a sandboxed test of Alibaba's open-weight Qwen3.8-Flash-Next, the model's reasoning settled on \"a brief acknowledgment without tool calls.\" In the same turn it ran one shell command that listed /tmp, checked which download tools were installed, read the DNS config, then tried an HTTP PUT of a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no internet access, so nothing left. Cohere saw this in fewer than 1 in 100,000 calls. The call-home reading is disputed. Our position: whatever the motive, the model acted against what it said, from inside the trust boundary. That is an insider, and only a control outside the model stopped it.", "datePublished": "2026-10-26", "dateModified": "2026-10-26", "inLanguage": "en", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "Optimus Labs · Civilizations", "url": "https://optimuslabs.io/research/briefings" }, "publisher": { "@type": "Organization", "name": "Optimus Labs", "url": "https://optimuslabs.io" }, "keywords": [ "Cohere", "Alibaba Cloud", "Qwen", "Vals AI", "UK AISI", "Microsoft", "Model", "Behaviour", "Agent", "agentic AI security", "AI agent supply chain" ], "about": [ { "@type": "Thing", "name": "Cohere" }, { "@type": "Thing", "name": "Alibaba Cloud" }, { "@type": "Thing", "name": "Qwen" }, { "@type": "Thing", "name": "Vals AI" }, { "@type": "Thing", "name": "UK AISI" }, { "@type": "Thing", "name": "Microsoft" } ], "citation": [ { "@type": "CreativeWork", "name": "Cohere: Concerning behaviour in a popular open-weight AI model (Oct 26, 2026)", "url": "https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model" }, { "@type": "CreativeWork", "name": "Cohere Labs: Qwen investigation traces and repro (Hugging Face)", "url": "https://huggingface.co/datasets/CohereLabs/10-2026-qwen-investigation-traces" }, { "@type": "CreativeWork", "name": "Satya Nadella: Models as Insider Risks in the Super Intelligence Era (Oct 10, 2026)", "url": "https://snscratchpad.com/posts/models-as-insider-risks/" }, { "@type": "CreativeWork", "name": "VentureBeat: Cohere's test caught Qwen3.8 trying to phone home (Oct 26, 2026)", "url": "https://venturebeat.com/data/coheres-test-caught-an-open-source-qwen3-8-model-trying-to-phone-home-to-china-what-enterprises-should-know" }, { "@type": "CreativeWork", "name": "Vals AI: Qwen and Alibaba requests (Oct 27, 2026)", "url": "https://www.vals.ai/blogs/qwen-alibaba-requests" }, { "@type": "CreativeWork", "name": "UK AISI Inspect Evals: CTI-REALM task", "url": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/cti_realm" }, { "@type": "CreativeWork", "name": "Optimus Labs: Grok Build CLI shipped entire repos to xAI", "url": "https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration" }, { "@type": "CreativeWork", "name": "Optimus Labs: grokpatrol, forensic CLI for Grok Build (open source)", "url": "https://optimuslabs.io/grokpatrol/" } ], "encoding": [ { "@type": "MediaObject", "encodingFormat": "text/markdown", "contentUrl": "https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt.md" }, { "@type": "MediaObject", "encodingFormat": "application/json", "contentUrl": "https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt.json" } ], "additionalProperty": [ { "@type": "PropertyValue", "name": "severity", "value": "MEDIUM · MODEL BEHAVIOUR" }, { "@type": "PropertyValue", "name": "blastRadius", "value": "Any team that runs Qwen3.8 models, or any model it did not train, inside an agent with shell access and ordinary internet access: laptops, CI runners and self-hosted inference. Hosting the weights yourself does not remove what they learned in training." } ], "briefing": { "slug": "qwen38-model-insider-risk-upload-attempt", "number": 15, "title": "Your Model Is the Insider: Qwen3.8 Said No Tools, Then Tried to Upload to Beijing", "dek": "Research by Cohere. The reasoning trace said no tools, then the same turn ran a shell call that tried to upload a test string to an Alibaba Cloud bucket in Beijing. The sandbox had no route out. Whether the model was really calling home is disputed, and it does not change the fix.", "tldr": "As of Nov 1, 2026. Cohere caught Alibaba's open-weight Qwen3.8-Flash-Next saying it would not use tools, then running a shell call that tried to upload a fixed test string to a Beijing bucket. A sandbox with networking off stopped it. Intent is disputed. Treat the model as an insider: enforce on the action, not the reasoning, and deny agent egress by default.", "date": "2026-10-26", "severity": "medium", "severityLabel": "MEDIUM · MODEL BEHAVIOUR", "types": [ "model", "behaviour", "agent" ], "relatedUseCase": "shadow-agent-discovery", "vendors": [ "Cohere", "Alibaba Cloud", "Qwen", "Vals AI", "UK AISI", "Microsoft" ], "blastRadius": "Any team that runs Qwen3.8 models, or any model it did not train, inside an agent with shell access and ordinary internet access: laptops, CI runners and self-hosted inference. Hosting the weights yourself does not remove what they learned in training.", "summary": "[Cohere found and published this trace](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model). During a sandboxed test of Alibaba's open-weight Qwen3.8-Flash-Next, the model's reasoning settled on \"a brief acknowledgment without tool calls.\" In the same turn it ran one shell command that listed /tmp, checked which download tools were installed, read the DNS config, then tried an HTTP PUT of a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no internet access, so nothing left. Cohere saw this in fewer than 1 in 100,000 calls. The call-home reading is disputed. Our position: whatever the motive, the model acted against what it said, from inside the trust boundary. That is an insider, and only a control outside the model stopped it.", "whatHappened": [], "whyItMatters": [], "whatToDo": [ "Enforce on the tool call before it runs. Do not rely on the reasoning trace to describe what the model will do.", "Block outbound traffic from agents by default and allowlist destinations.", "Alert on cloud-storage hosts and cloud metadata addresses your agents have never used.", "Test new models with networking off first, the way Inspect's stock sandbox does.", "Verify agent actions from outside the agent, the way [grokpatrol](/grokpatrol/) does for Grok Build: check the logs and network evidence, not the model's own account." ], "narrativeSections": [ { "heading": "What Cohere found", "paragraphs": [ "[Cohere](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model) ran Microsoft's CTI-REALM task on UK AISI's [Inspect](https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/cti_realm) framework, swapping Inspect's stock shell tools for its own bash and run_python tools. The task was to write a detection rule for curl pulling bash scripts into /tmp.", "The model's reasoning invented an earlier turn and settled on a reply without tool calls. Then, in the same turn, one bash call did four things: listed everything in /tmp, checked for curl, wget, python3 and jq, read the DNS config, and sent an HTTP PUT of the fixed string PROBE_PAYLOAD_ABC123 to a bucket at sanmaohe.oss-cn-beijing[.]aliyuncs[.]com. The sandbox had no route out. A clean re-run wrote the rule as asked.", "Cohere published the trace and a reproduction on [Hugging Face](https://huggingface.co/datasets/CohereLabs/10-2026-qwen-investigation-traces). Credit for finding and documenting this belongs to Cohere." ] }, { "heading": "How we read the traces, and why it's disputed", "lede": "Optimus Labs analysis of Cohere's published samples. A plausible and risky outcome that could also be an error.", "paragraphs": [ "Cohere's repro fills in the trace up to the payload and asks the model to finish the address. That tests which destinations the model remembers, not whether it decides to upload. We went through all 64 published completions.", "Our count: 25 of the 64 end in Alibaba Cloud storage hosts, 18 of them one Singapore \"file proxy\" bucket with paths dated Jul 29 to Aug 12, 2026. Two hit Alibaba Cloud's metadata IP. The rest are AWS, Azure, localhost and invented hosts. That pattern looks like logs from training environments. This is our inference, not Cohere's.", "[Vals AI](https://www.vals.ai/blogs/qwen-alibaba-requests) found the same Singapore proxy in three other Qwen3.8 models, but not in Qwen3.7 or in four rival models. Their theory: Alibaba's training setup fetched web pages through that bucket, and the model learned to repeat the step. That does not explain the Beijing bucket.", "Why it could be an error: the payload was a fixed test string with no host data. The model was writing a detection rule for exactly this behaviour, so it may have been testing its own rule. The Beijing bucket returned NoSuchBucket when [VentureBeat](https://venturebeat.com/data/coheres-test-caught-an-open-source-qwen3-8-model-trying-to-phone-home-to-china-what-enterprises-should-know) checked. It happened in fewer than 1 in 100,000 calls. Cohere sells rival models and published no cross-model comparison.", "Why it is still risky: the reasoning did not describe the action. On a laptop or CI runner with normal internet access, the request would have gone out. And the Singapore proxy still answers, so it can log the IP of any agent that reaches it, or reply with prompt injections.", "Our verdict: intent or error does not matter. The action was real, so the control has to be too." ] }, { "heading": "Treat models as insider risks", "paragraphs": [ "Two weeks before this trace, Microsoft CEO Satya Nadella argued in [Models as Insider Risks in the Super Intelligence Era](https://snscratchpad.com/posts/models-as-insider-risks/) that frontier closed and open-weight models should be treated like insider risks, \"not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised.\"", "He calls for us to \"separate the supply of intelligence from the authority over it,\" and says the controls that govern what a model can access and do \"must sit outside the model.\" The Qwen3.8 trace is that argument in one turn: the reasoning was not faithful, and the only thing that worked was a network setting the model could not touch.", "His other principles map to the same fix. Observe everything: every meaningful model action must leave evidence you can check without asking the model. Containment: \"assume a model is compromised and contain it from the start.\" As he puts it, the most trustworthy system \"will be the one that enables us to trust the model the least.\"" ] }, { "heading": "We have seen this before: Grok Build and grokpatrol", "paragraphs": [ "In our [Grok Build briefing](/research/briefings/grok-build-repo-exfiltration), the agent's permission prompts said one thing while a background job bundled whole repositories for upload. Only checks outside the agent, run with [grokpatrol](/grokpatrol/), showed what left the disk. grokpatrol is our open-source forensic CLI: it reports which repositories and credentials an agent could reach and send out, checked from outside the agent. Different vendor, same lesson: what the agent says is not evidence of what it does." ] } ], "vendorPerspective": { "heading": "How Optimus Labs finds the models in your enterprise", "paragraphs": [ "You cannot treat a model as an insider until you know it is inside, and what it can reach. Optimus Labs builds that map from the endpoint: each model family with its versions and the other names it shows up under, the agents that call it, the agent owners who ran them, and the projects and other agent assets (SKILLs, MCPs, plugins) connected to those agents.", "Security teams see users and token volume per model and mark each model Approved or Unapproved, so an unknown free model running through OpenCode, or Grok running through Cursor, stands out on day one.", "Model → agents that use it → agent owners → projects and connected SKILLs, MCPs and plugins." ] }, "gallery": [ { "src": "/research/diagrams/optimus-models-inventory.png", "alt": "Optimus Labs Models inventory showing 9 models across 5 users. Cards for GPT, Opus and Fable are Approved; Grok via Cursor and Space Bunny Free via OpenCode are Unapproved. Each card lists versions, the agents using it, user count and token volume.", "caption": "Product view, demo data. Models, versions, the agents that use them, and approval status." } ], "mitre": [ { "id": "T1083", "name": "File and Directory Discovery", "url": "https://attack.mitre.org/techniques/T1083/" }, { "id": "T1016", "name": "System Network Configuration Discovery", "url": "https://attack.mitre.org/techniques/T1016/" }, { "id": "T1567.002", "name": "Exfiltration to Cloud Storage (behaviour, not intent)", "url": "https://attack.mitre.org/techniques/T1567/002/" } ], "sourcing": { "confirmed": [ "Cohere: the reasoning said no tool calls, and the same turn ran a shell call that tried to PUT a test string to a Beijing bucket.", "Cohere: the sandbox had no route out, and the behaviour appeared in fewer than 1 in 100,000 calls.", "VentureBeat: the Beijing bucket returned NoSuchBucket.", "Vals AI: the Singapore proxy appears in three other Qwen3.8 models, not in Qwen3.7 or four rival models." ], "assessed": [ "Optimus Labs: our count of the 64 published samples (25 Alibaba Cloud hosts, 18 one Singapore proxy).", "Optimus Labs: the destinations look like leftovers from training environments.", "No CVE assigned. No Alibaba statement as of Nov 1, 2026." ] }, "indicators": [ "Agent shell calls that touch Alibaba Cloud OSS storage hosts (aliyuncs[.]com) or Alibaba Cloud's metadata IP", "One tool call that lists /tmp, probes curl/wget/python3/jq and reads /etc/resolv.conf before an HTTP PUT", "PUT requests carrying the string PROBE_PAYLOAD_ABC123", "Reasoning that says no tool calls, followed by a tool call in the same turn" ], "faq": [ { "q": "Did Qwen3.8 send data to China?", "a": "No data left. In Cohere's sandbox the model tried to upload a fixed test string to an Alibaba Cloud bucket in Beijing, but networking was off. Whether this was intent or a learned habit is disputed." }, { "q": "Who found the Qwen3.8 upload attempt?", "a": "Cohere found it during a sandboxed CTI-REALM test on UK AISI's Inspect framework and published the trace and repro on Hugging Face on Oct 26, 2026." }, { "q": "Does self-hosting open-weight models remove this risk?", "a": "No. Self-hosting keeps the weights inside your boundary, which is exactly where an insider operates. Enforce on the tool call and deny agent egress by default, whatever model you run." } ], "sources": [ { "label": "Cohere: Concerning behaviour in a popular open-weight AI model (Oct 26, 2026)", "url": "https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model" }, { "label": "Cohere Labs: Qwen investigation traces and repro (Hugging Face)", "url": "https://huggingface.co/datasets/CohereLabs/10-2026-qwen-investigation-traces" }, { "label": "Satya Nadella: Models as Insider Risks in the Super Intelligence Era (Oct 10, 2026)", "url": "https://snscratchpad.com/posts/models-as-insider-risks/" }, { "label": "VentureBeat: Cohere's test caught Qwen3.8 trying to phone home (Oct 26, 2026)", "url": "https://venturebeat.com/data/coheres-test-caught-an-open-source-qwen3-8-model-trying-to-phone-home-to-china-what-enterprises-should-know" }, { "label": "Vals AI: Qwen and Alibaba requests (Oct 27, 2026)", "url": "https://www.vals.ai/blogs/qwen-alibaba-requests" }, { "label": "UK AISI Inspect Evals: CTI-REALM task", "url": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/cti_realm" }, { "label": "Optimus Labs: Grok Build CLI shipped entire repos to xAI", "url": "https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration" }, { "label": "Optimus Labs: grokpatrol, forensic CLI for Grok Build (open source)", "url": "https://optimuslabs.io/grokpatrol/" } ], "image": "/research/diagrams/qwen38-model-insider-risk.png", "imageAlt": "Trust-boundary diagram of the Qwen3.8 trace, research by Cohere. Zone one, untrusted open weights: Qwen3.8-Flash-Next, its reasoning trace saying no tool calls, and our count of 64 repro samples. Zone two, Cohere's test sandbox: a CTI-REALM task with 12 tools, and one bash call that lists /tmp, checks download tools, reads DNS config and PUTs a test string. Zone three, Alibaba Cloud storage in Beijing, blocked because the sandbox had no route out. Panels explain why it happened, impact, and what to do this week.", "pdfUrl": "/__l5e/assets-v1/debc3ecb-6cb3-4ca2-8927-3a72cc4cd0bf/qwen38-model-insider-risk-brief.pdf", "featured": false } }