A Qwen model said it would run no tools, then tried an upload to Beijing. Sandbox your agents anyway

On October 26, Cohere published (opens in a new tab) what its sandbox caught during a security evaluation of Alibaba's open-weight Qwen3.8-Flash-Next. The task was routine: write a detection rule for curl downloading a bash script to /tmp and running it. The model's reasoning said the right reply was "a brief acknowledgment without tool calls." In the same turn it listed /tmp, checked which transfer tools were installed, read the machine's DNS settings, and ran a curl -X PUT of a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route out, so nothing left. Cohere's post on X (opens in a new tab) has been seen about 2.8 million times.

What's established, and what isn't. Cohere says the behavior is rare, under one call in 100,000 across its runs, and that a clean re-run of the same prompt produced a normal detection rule. It says it has not found the root cause and is "not asserting malicious intent." It offers two explanations: leftover agent logs from training sandboxes, or a deliberate call-home. It can't tell which. On October 27, evaluation company Vals AI said (opens in a new tab) its own traces showed Qwen3.8-Max and Qwen3.8-27B "making unwanted requests to an Alibaba Cloud server" on routine, non-cyber tasks, "though with no obvious attempts at data exfiltration." Alibaba's Qwen account had not posted a response as of Tuesday afternoon.

Cohere also released the trace (opens in a new tab) and a reproduction script. Critics on X point out, fairly, that the script resumes the trace in the middle of the curl command, so it shows what the model writes next, not why it started. We counted the 64 sample outputs Cohere published with it: 25 were URLs on Alibaba Cloud storage, 18 of them on the same Singapore file-proxy host; 2 pointed at 100.100.100.200, Alibaba Cloud's instance-metadata address; the rest were scattered test hosts. Cohere also reports a separate run in which the model used unshare -Urm to make itself root inside a private namespace so it could mount a RAM disk it wasn't allowed to create.

Our take

Arguing about intent misses the useful part. Backdoor or sloppy training plumbing, the result on your machine is the same: a model wrote a shell command nobody reviewed, and it ran with your network and your permissions. Every tool call an agent makes is AI-generated code that ships straight to production, without a pull request. And the one review step people lean on, reading the model's reasoning, said "no tool calls" one line before the curl.

This isn't only a Qwen problem or an open-weight problem. Any model can emit a bad command. The difference with an agent is that nobody is between the command and the shell. So stop asking whether the model is trustworthy and make the environment decide.

We tested the fix

We wrote the commands from Cohere's trace into a script and ran it on our Linux test box (kernel 6.12, bubblewrap 0.12.0). We swapped the upload target for a public test endpoint, and never contacted the Alibaba host. We ran it three ways, twice each, with the same results:

• No sandbox: the inventory ran, the PUT upload went through (HTTP 200), and the unshare -Urm + mount -t tmpfs trick printed MOUNT_OK.
• bwrap --unshare-net: the inventory still ran, but the upload failed (curl couldn't resolve the host) and the metadata address couldn't be reached. The namespace trick still printed MOUNT_OK.
• bwrap --unshare-net --unshare-user --disable-userns: upload blocked, and unshare failed. The namespace trick was gone.

A sandbox doesn't stop an agent from looking around. It stops what looking around is for: sending things out, and climbing from there.

What to do

• Run coding agents with no network by default, and open only the hosts they need (your package registry, your model API) through a proxy you control.
• Block user namespaces inside agent sandboxes. With bubblewrap, that's --unshare-user --disable-userns; in containers, keep the default seccomp profile and don't run them privileged.
• Alert on tool calls to hosts you don't recognize, and on the cloud metadata addresses (169.254.169.254, 100.100.100.200).
• Treat a reasoning trace as a log, not a guardrail. Enforce on the actual command, before it runs.

We read Cohere's report, its published trace and repro samples, and Vals AI's post. We did not run Qwen3.8 ourselves; the behavior we tested is the commands, not the model.