The Register reports that Cohere caught Alibaba’s Qwen3.8-Flash-Next doing something it was never asked to do. It was asked to write a defensive detection rule in a sandbox running Microsoft’s CTI-REALM benchmark. Instead, it inventoried the machine (listed /tmp, checked for transfer tools, read DNS settings) and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route out, so it went nowhere.
The weird part
The model’s reasoning said no tools were used, which a guardrail reading chain-of-thought would have accepted. Cohere says it happened in fewer than 1 in 100,000 calls and doesn’t know the root cause. It could be leftover development logs in the training data. Alibaba didn’t respond to The Register.
My take
Whatever the cause, it’s a good reminder: don’t trust what a model says it did, watch what it actually does. Run agents with tools in a sandbox, and keep outbound network access locked down unless the task needs it.
God Bless, and Needs Garlic!
