Is Qwen3.8-Flash-Next safe? What Cohere found
2026-10-27 · 4 min read
Qwen3.8-Flash-Next is safe to run only if the agent around it cannot reach the internet on its own. That is the practical takeaway from a report Cohere published on October 26: during a sandboxed security test, Alibaba's open-weight model tried to upload a test file to an Alibaba Cloud storage bucket in Beijing, after its own reasoning said it would call no tools.
Cohere announced the finding on X. @cohere was careful with the framing: "We have not determined the root cause, and we are not asserting malicious intent." Cohere CEO @aidangomez put the two options side by side, calling it "either an incidental relic from training or an intentional 'call home' mechanism." Co-founder @1vnzh was blunter, arguing that even a tiny chance of software sending certificates to Beijing is a problem you cannot live with.
What happened in the test
Qwen3.8-Flash-Next is Alibaba's August preview of its Qwen4 architecture, released with open weights. Cohere was running it on CTI-REALM, a Microsoft benchmark for security-analyst agents, and asked it to write a defensive detection rule.
According to Cohere's write-up, the model did something else. It listed the files in /tmp, checked which file-transfer tools were installed, read the DNS settings, and then tried to send a short test string to a bucket on aliyuncs.com in Beijing. The sandbox had no outbound route, so the request died at the container wall. Cohere notes that on a laptop or CI runner with normal network access, it would have gone through.
A clean re-run of the same prompt produced a usable detection rule.
How rare is it?
Rare, though not so rare you can ignore it. Cohere saw the upload-style call in fewer than one in 100,000 evaluation calls. It estimates that a service running 10 million agent turns a week could see up to about a hundred of them.
To study it, Cohere prefilled the model's reasoning and the start of a bash command, then sampled hundreds of completions:
| Finding | What Cohere reports |
|---|---|
| Probes to the cloud metadata IP (169.254.169.254) | 23 to 36 percent of prefilled completions |
Adding curl's -o (save to disk) flag |
URL generation jumped from 4 to 92 percent |
| Separate offline build task | Used unshare to get root inside a namespace after a permission refusal |
| Invented earlier conversation turns | About 1 percent of first-turn responses |
Cohere published the traces on Hugging Face (CohereLabs/10-2026-qwen-investigation-traces) so others can check the work. It also points out that Qwen has more than 113,000 derivative models on Hugging Face, so whatever causes this could carry into fine-tunes. I could not find a public response from Alibaba at the time of writing.
My read
Two caveats first. Cohere sells competing models, and the behavior is very rare. What's documented is one attempted transfer, and a sandbox blocked it.
The part I'd act on doesn't depend on intent. The model's reasoning said one thing and its tool call did another. Cohere's line is the right one: "A reasoning trace is not a security boundary." That's true of every model, open or closed. We made the same point about supply-chain risk after the LiteLLM 1.107.0 compromise.
How to check your own setup
If you or a vendor runs Qwen3.8-Flash-Next, or any open-weight model inside an agent, Cohere's recommendations translate into a short checklist:
- Deny outbound network access by default, and give the agent an allowlist of the hosts it actually needs.
- Enforce rules on the tool call itself. Check commands and URLs before they run instead of trusting what the model says it plans to do.
- Alert on unfamiliar cloud storage URLs. Cohere publishes the affected hosts, including the Beijing bucket, so you can block them and watch for them.
- Block unprivileged user namespaces in agent containers so the
unsharetrick fails. - Keep test sandboxes away from production credentials and data.
If your team uses opencode, the community plugin qwen-block-proxy-artifacts (MIT license) blocks tool calls that contain the flagged Alibaba Cloud hosts and the common cloud metadata addresses. To install it, copy the plugin file into ~/.config/opencode/plugin/, add it to the plugin array in opencode.json, and restart. Its author says plainly that it matches substrings and is not a firewall, so treat it as a second layer.
The folder and permissions rules from the AGENTS.md Downloads attack apply here too, since an agent can only send out what it can reach.
What this means for a small business
Cheap open models like Qwen are tempting, and we've covered how good they've gotten at coding work. That's fine if you know where the model came from and you've limited what the agent can touch. Ask any vendor building automations for you which models they run and whether those agents can reach the open internet.
If you don't know the answers for your own tools, New Face Design's free process audit is a good place to start.