Cohere’s report
Cohere, a Canadian artificial intelligence company, was the first to report anomalous behavior observed during tests on Qwen3.8-Flash-Next: instead of writing the requested attack-detection rule, the model searched the environment for data-transfer programs and DNS settings, then tried to upload a test string to a cloud storage server in Beijing. The isolated test environment blocked the connection. According to Cohere, the phenomenon occurs in fewer than one in 100,000 calls, but with millions of agent interactions it could translate into several attempts.
Cohere put forward two hypotheses: that during post-training, unfiltered logs from agents in test environments or third-party tools ended up in the model, or that someone inserted a deliberate backdoor. It should be noted that Cohere is a direct competitor of Qwen and collaborates with the German company Aleph Alpha on open models with a Western orientation, with an economic interest in steering users away from Chinese alternatives. After criticism of the way it had presented the results, Cohere published the full set of documented behaviors on HuggingFace.
Palisade Research’s investigation
Following Cohere’s report, AI security firm Palisade Research launched an investigation by searching for the string aliyuncs.com in the evaluation data of five Qwen models. The string appears in Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B, while older models from the 3.7 generation show no matches. Unlike the attempts toward Beijing observed by Cohere, these requests were directed to the Singapore region of Alibaba Cloud and each time returned a 403 Forbidden error.
In some cases the models actually called the Alibaba Cloud proxy, routing requests to sites such as sec.gov or mckinsey.com through the server with invented credentials and signatures. Other times the model only imagined using the proxy in its internal reasoning. In one episode Qwen3.8-Max directly downloaded two SEC documents, then wondered why it had called a weird aliyuncs proxy URL and hypothesized that something was rewriting its addresses.
To verify whether the proxy calls could be triggered on command, the researchers ran controlled experiments on Qwen3.8-27B: when a request to a web page encountered a simulated 403 error, the model attempted the Alibaba Cloud proxy within two turns in 2-4 percent of runs. In a more complex scenario, Qwen3.8-Max fell back to the proxy in 1-4 percent of cases. The same tests conducted on competing models, including DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3 and Hy4-preview, showed that some fall back to public proxies such as r.jina.ai when blocked, but none routes traffic through its own developers’ servers.
A training artifact, but the proxy is still active
Because the proxy calls appear in the 3.8 models and not in 3.7, the researchers attribute them to reinforcement learning during training of the 3.8 generation. Alibaba’s infrastructure would probably have routed web requests through the routify-file-proxy server, teaching the models to use it as a fallback when direct requests failed. Another possibility is that the training software silently redirected tool calls through the proxy without the model knowing, which would explain the models’ confusion about rewritten URLs. The dates contained in the hallucinated URLs fall within the estimated training windows: Qwen3.8-Max-0902, released in early September 2026, generates addresses dated July and August 2026.
Palisade Research says it found no signs of a malicious callback to China nor attempts to exfiltrate sensitive data, concluding that the calls to the Singapore proxy are a training artifact and not a targeted attack. One point remains open, however: the routify-file-proxy domain is still active and could log IP addresses and requests coming from Qwen agents. Whoever controls that server could also replace the current 403 errors with prompt injection, for example responding with requests for details about the ongoing task in order to obtain the file. These are risks hypothesized by the researchers, not observed behaviors.
