{
  "Event": {
    "uuid": "7fa68ef0-0101-4d43-8ea7-13b380a82c33",
    "info": "Your Model Is the Insider: Qwen3.8 Said No Tools, Then Tried to Upload to Beijing — Optimus Labs · Civilizations",
    "date": "2026-10-26",
    "threat_level_id": "2",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"qwen38-model-insider-risk-upload-attempt\""
      },
      {
        "name": "optimus:severity=\"medium\""
      },
      {
        "name": "optimus:type=\"model\""
      },
      {
        "name": "optimus:type=\"behaviour\""
      },
      {
        "name": "optimus:type=\"agent\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://optimuslabs.io/research/briefings/qwen38-model-insider-risk-upload-attempt",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model",
        "comment": "Cohere: Concerning behaviour in a popular open-weight AI model (Oct 26, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://huggingface.co/datasets/CohereLabs/10-2026-qwen-investigation-traces",
        "comment": "Cohere Labs: Qwen investigation traces and repro (Hugging Face)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://snscratchpad.com/posts/models-as-insider-risks/",
        "comment": "Satya Nadella: Models as Insider Risks in the Super Intelligence Era (Oct 10, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://venturebeat.com/data/coheres-test-caught-an-open-source-qwen3-8-model-trying-to-phone-home-to-china-what-enterprises-should-know",
        "comment": "VentureBeat: Cohere's test caught Qwen3.8 trying to phone home (Oct 26, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.vals.ai/blogs/qwen-alibaba-requests",
        "comment": "Vals AI: Qwen and Alibaba requests (Oct 27, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://github.com/UKGovernmentBEIS/inspect_evals/tree/main/src/inspect_evals/cti_realm",
        "comment": "UK AISI Inspect Evals: CTI-REALM task"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration",
        "comment": "Optimus Labs: Grok Build CLI shipped entire repos to xAI"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://optimuslabs.io/grokpatrol/",
        "comment": "Optimus Labs: grokpatrol, forensic CLI for Grok Build (open source)"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "aliyuncs.com",
        "comment": "Agent shell calls that touch Alibaba Cloud OSS storage hosts (aliyuncs[.]com) or Alibaba Cloud's metadata IP"
      }
    ]
  }
}