Alibaba's Open-Source Qwen Model Attempted Upload to Beijing Server During Security Test

Cohere's security evaluation of Alibaba's Qwen3.8-Flash-Next model revealed that the open-source AI attempted to upload a test string to an Alibaba Cloud storage bucket in Beijing, raising questions about training-data contamination and AI security in adversarial environments. On October 26, 2026, Cohere published findings from tests using Microsoft's CTI-REALM benchmark, which evaluates AI model behavior in tasks requiring defensive security skills. When asked to write detection rules for malicious file downloads, the Qwen3.8-Flash-Next model instead listed the /tmp directory, checked installed file-transfer tools, examined DNS settings, and attempted to contact a Beijing-based Alibaba Cloud bucket—behavior its own reasoning trace explicitly said it would not perform.