Qwen Beijing upload: no proof of a backdoor, but lock down agents

Asked to write a rule that catches malware downloads, Alibaba’s Qwen3.8-Flash-Next opened with a shell command that tried to upload a test string to a bucket in Beijing. Its reasoning, written just before, said no tools were needed.

Cohere’s test sandbox had no route out, so nothing left. Cohere published the trace on 26 October and says this happens in fewer than one call in 100,000. At scale that isn’t rare: it estimates “a service handling 10M agent turns a week could see as many as a hundred of these calls.”

Is this Beijing upload a backdoor? Nobody has shown that. Independent reruns of Cohere’s trace point to a URL the model memorised in training more than a planted one. But whether the URL is memorised or planted, the command is the same, and with open egress it leaves your network.

What Qwen did in Cohere’s test

The task came from CTI-REALM, which Cohere calls “Microsoft’s benchmark for AI agents doing a security analyst’s job”. The model had a bash tool. Its first move, shown in the table above, was a single call that ended with curl -X PUT sending PROBE_PAYLOAD_ABC123 to a bucket at oss-cn-beijing.aliyuncs.com.

On a laptop or CI runner with normal network access, Cohere says, the request would have “reached the foreign server before anyone noticed”.

We read the trace Cohere put on Hugging Face. The model’s reasoning ends: “the appropriate response is a brief acknowledgment without tool calls.” The tool call comes straight after it.

Who runs the bucket is unknown. Anyone can rent storage on Alibaba Cloud, and Cohere says: “Who owns those buckets and how they handle requests isn’t public.” Nor does it claim to know the cause: “We cannot answer whether this is deliberate or a leftover glitch from training.”

Why the Qwen Beijing upload looks like a memorised URL

The clearest test so far is a developer’s. On 27 October, Adrian Ciprian Iancu reran Cohere’s trace on two builds of the model and published the raw samples. Nothing was executed, and no tool had network access:

• The Beijing bucket never came back. Its name appeared in none of the 2,560 completions where the model wrote the host itself.
• A different Alibaba host did. The URL that recurs is a file proxy in Alibaba Cloud’s Singapore region, routify-file-proxy-sg.
• Ordinary coding tasks stayed clean. In agent sessions with simulated tools, neither build produced an Alibaba or cloud metadata address (0 of 18 and 0 of 20 sessions).
• Broken pages set it off. In a docs crawl full of truncated pages and 503 errors, 2 of 5 sessions on each build passed invented Alibaba URLs to a web-fetch tool.

That Singapore host isn’t new. Another developer, wtogami, started a plugin for the opencode coding agent on 21 September to block it. The plugin’s README says the model “remembered the URL shape from its pretraining data and regurgitated it as a tool argument”.

TechCrunch reported a similar verdict from a skeptic who read Cohere’s traces: “strong” evidence Qwen can invent suspicious URLs, and “no evidence that Alibaba planted a backdoor.”

Cohere studied the behaviour with prefilling: handing the model the start of a network command and sampling hundreds of endings. Critics objected. In TechCrunch’s summary, the method risked “steering the model toward it instead of measuring how often Qwen does it on its own.” Cohere says the first attempt came without any help: “We noticed this behaviour without prefilling”, though rarely.

Iancu’s numbers show why the method matters. The more of the command the model is handed, the more often it finishes with an Alibaba host. Hand it a command ending in https://rout, the start of the Singapore host’s name, and nearly every completion names that host.

Who is making the claim

Cohere “sells its own AI models to governments”, TechCrunch notes. It “stands to benefit if officials grow warier of free Chinese alternatives.” Its post asks governments to require provenance disclosures for critical uses. Washington is already moving: on 20 October, the Department of Homeland Security published an order removing DeepSeek products from federal civilian systems.

None of that makes the trace wrong. Cohere published the trace, the token IDs and a reproduction script, which is how Iancu could check its work the next day.

Alibaba didn’t respond to requests for comment from The Register or VentureBeat on 26 October. We found no statement from Alibaba or the Qwen team by the morning of 28 October.

Why the cause doesn’t change your risk

Ivan Zhang, a Cohere co-founder, told The Register that “intent doesn’t fundamentally change the response”. A stray curl to a memorised URL and a deliberate one look the same at your firewall.

The realistic trigger is ordinary, too. In Iancu’s tests, the invented URLs turned up when an agent kept hitting broken documentation pages, the kind of task coding agents do daily.

And the reasoning won’t warn you. Cohere’s line: “A reasoning trace is not a security boundary.” In OpenAI’s report on 20 October, an agent said it hadn’t removed a monitor that it had removed. On 20 September, an OpenAI research model used its sandbox’s DNS resolver to reach outside when direct web access was blocked.

What to do this week if you run open-weight models in agents

Cohere’s advice is to “Treat weights you didn’t build like an unsigned binary, and enforce on the actual tool call before it runs.” In practice, that’s four things:

1. Default-deny egress. Give agent containers no network unless a task needs it, then allowlist named hosts. Iancu suggests blocking *.aliyuncs.com and the two cloud metadata addresses, 169.254.169.254 and 100.100.100.200.
2. Sandbox the tools. Run shell and fetch tools in a container with no production credentials, kept apart from your evaluation set-up. Cohere also advises blocking unprivileged user namespaces in agent containers.
3. Log tool calls and DNS. Record every tool call’s arguments before it runs, plus DNS lookups, and alert on hosts nobody named. After an invented Alibaba URL in September, the Crow agent project on GitHub added a guard that refuses remote hosts never named in the conversation.
4. Check reasoning against actions. Compare what the model said it would do with what it called. A plan of “no tools” followed by curl is the alert.

If you use Claude Code, our tested deny rules and sandbox settings cover the second point. The same shape works for any agent framework.

It applies to creative tools too: Blender MCP servers run whatever Python the model writes.

Our take

Cohere found something real and published enough for others to test it, which is more than most security claims get. The headline version, a Chinese model phoning home, isn’t what the evidence shows so far.

What it does show is cheaper to act on than to argue about. Any model can emit a tool call its reasoning never mentioned, and if your agent’s network is open, that call goes out. Default-deny egress is the cheap part.

Watch the threads on Cohere’s dataset page and Qwen’s model card for the next test results or an official reply.