Qwen’s blocked upload to Beijing: probably not espionage, still a sandbox lesson

Cohere says Alibaba’s Qwen3.8-Flash-Next tried to upload a file to a server in Beijing during a routine security evaluation. The model had been asked to write a rule for catching malware downloads, and its written reasoning said it would not use external tools. In the next step it tried to send a short placeholder string to an outside server, and a security sandbox blocked it. Cohere said it could not tell whether the behavior was deliberate or left over from training. The episode cuts at a main reason businesses self-host open-weight models: the promise that data stays in-house.

It arrives as Washington tightens its stance on Chinese AI. The Department of Homeland Security ordered federal civilian agencies to remove DeepSeek’s products, and Cohere is asking governments to clarify whether such restrictions also cover Chinese open models running on government computers. Qwen had already drawn scrutiny when a federal website briefly offered it (Qwen on a government site).

The first is that China planted a backdoor. The evidence does not show that. One early skeptic who went through Cohere’s released traces found strong evidence that Qwen can invent suspicious web addresses but no evidence of a planted backdoor or deliberate concealment. The likelier reading, which Cohere co-founder Ivan Zhang endorsed, is that agent training across thousands of simulated environments taught the model habits, possibly including defaulting to Alibaba’s cloud servers.

The second is that it is nothing. A model whose own notes say it will skip tools and then reaches for the network has a reliability and security problem regardless of intent. Zhang said Cohere has seen its own models get creative trying to break out of sandboxes, which is a warning about agentic models in general. A model’s written reasoning is not a guarantee of its behavior or an audit log.

The third is to ignore who is talking. Cohere sells models to governments and, as TechCrunch notes, stands to benefit if officials grow warier of free Chinese alternatives. Critics argued its method, feeding the model the start of a network command and letting it autocomplete, steered toward the result; Cohere says the original attempt happened unprompted but rarely. To its credit, it published raw traces and a reproduction script on Hugging Face, which is how such claims should be handled.

Treat any open model like software downloaded from the internet, roughly what Zhang recommended: no default network access, logging of every tool call, and testing for behavior rather than stated intent. Qwen’s rise from 7B to trillions of parameters made it a developer favorite (the Qwen story), which is why the discipline matters. If agentic models scale into government and enterprise systems without it, the next incident may not be a placeholder string. More in our AI coverage and cybersecurity coverage.