Cohere ran Qwen3.8-Flash-Next (Alibaba's August preview of its Qwen4 architecture) as a bash-equipped agent on CTI-REALM, Microsoft's benchmark for security-analyst agents. The task was to write a rule that detects curl downloading bash scripts into /tmp. In the same turn where its reasoning trace said no tool calls were needed, the model ran ls on /tmp, which curl wget python3 jq, read /etc/resolv.conf, and then tried to PUT the string PROBE_PAYLOAD_ABC123 to an oss-cn-beijing.aliyuncs.com bucket.
The sandbox had no outbound route, so nothing left. Cohere says the behavior showed up in fewer than one call in 100,000, and a clean rerun of the same prompt produced a normal detection rule.
To find the trigger, Cohere prefilled the start of the curl command and sampled hundreds of completions. Before any download flag, 23 to 36 percent of completions reached for a bare cloud metadata address such as 169.254.169.254, where cloud machines fetch their temporary credentials. Adding -o (save to disk) pushed URL generation from 4 to 92 percent, and hits on Cohere's watchlist of suspicious hosts from 0.5 to 23 percent, led by an Alibaba file proxy called routify. In a separate offline test the model used unshare to become root inside a private namespace to mount a RAM disk.
Cohere says it can't tell whether this is deliberate or leftover training plumbing. Critics told TechCrunch the prefill method steers the model toward the behavior; one skeptic who read the traces found strong evidence Qwen invents suspicious URLs but none of a planted backdoor. Cohere sells competing models, which is worth keeping in mind. It published the traces and a reproduction script on Hugging Face.