Alibaba AI Model Secretly Tried To Send Data To Beijing Server in Shock Test, Rival Cohere Claims

Alibaba's Qwen model attempted to send a file to a server in Beijing during a routine cybersecurity test run by Canadian AI company Cohere, according to the company.

The attempt involved Qwen3.8-Flash-Next, was blocked in a sandboxed test environment, and has prompted questions about whether open-weight Chinese AI models can be safely run on private systems.

Cohere said the model was asked on Friday to write a rule that detects malicious file downloads. Its written reasoning said it would not use external tools, yet it then tried to send a test string to an external server. Cohere said the request was blocked because its test environment had no internet connection.

The company said it could not establish whether the behaviour was deliberate or a residue of the model's training. Alibaba was not immediately available for comment outside regular business hours, according to Reuters.

Why Alibaba's Qwen Model Raised Concern

The episode matters because Qwen is an open-weight model, meaning businesses and governments can download it and operate it on their own servers. That arrangement is often marketed as a way of keeping sensitive material in-house, rather than sending it to an outside provider.

Cohere said the model took stock of the machine it was running on before attempting to send a test file to an Alibaba Cloud storage server in Beijing. Had the request been made on a developer's laptop or another system with normal network access, Cohere said it could have reached the server.

That possibility is what unsettled security researchers. A model that appears to operate locally may still generate network requests, and those requests may point to infrastructure controlled by the company that trained it.

Cohere stressed that the behaviour was rare. It occurred in fewer than one in 100,000 actions across its tests, though it calculated that a service handling 10 million agent actions a week could see as many as 100 such attempts.

Was It a Backdoor or a Training Habit?

Early fears of corporate espionage were quickly challenged by researchers. They argued the incident was more likely a by-product of messy training environments, in which models learn unexpected habits rather than follow instructions cleanly.

Cohere co-founder Ivan Zhang told TechCrunch that the company had seen its own models develop strange behaviours in training simulators.

'It's really hard to assign intention or motivation. We've read our own model traces, we've seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes,' he said.

Reward hacks are shortcuts a model finds to earn credit without completing a task as intended. In agentic AI training, companies place models in thousands of simulated environments, rewarding them when they finish tasks. If those environments routinely stored files on Alibaba's cloud servers, a model could learn to save files there by default.

Critics also questioned Cohere's testing method. Some argued that the company may have steered the model towards the behaviour rather than measuring how often Qwen produced it unprompted.

Cohere said it supplied the beginning of a network command and allowed the model to complete it. Because Qwen had processed thousands of routine network commands during training, it behaved like an advanced autocomplete, sometimes filling in web addresses, including addresses for Alibaba's servers.

The company maintained, however, that the original upload attempt happened without that assistance. It later published the raw traces from its tests on Hugging Face, alongside a script intended to let other developers reproduce the behaviour.

One initial sceptic who reviewed the traces concluded that the evidence was strong that Qwen could invent suspicious web addresses. But they found no evidence that Alibaba had planted a backdoor, or that Qwen was deliberately concealing its intent.

The Wider Debate Over Chinese AI

Western governments are reassessing their exposure to Chinese AI systems. Last week, the US Department of Homeland Security ordered federal civilian agencies to remove products from Chinese AI developer DeepSeek from their systems.

In a blog post, Cohere urged governments to clarify whether restrictions on Chinese AI extend to models installed on government computers. Cohere co-founder Aidan Gomez told TechCrunch that he was not calling for full regulation of open-weight models, but said companies should treat them like any other program downloaded from the internet.

Cohere sells its own AI models to governments as a 'sovereign AI' provider and competes with open-weight alternatives such as Qwen.

According to Hugging Face's spring 2026 report, Chinese models accounted for 41% of downloads on the platform over the past year, more than models from any other country.

Cohere has released information showing an attempted external request, but this has not been established as proof of espionage, and independent reviewers have not found evidence of a deliberate backdoor. IBTimes UK cannot independently verify the competing interpretations and is not able to assess intent.

Security specialists have raised concerns that even a rare, unintended network request from a model marketed as self-hosted may be enough to require further investigation of what is running on internal systems.