Cohere: Qwen3.8-Flash-Next Reaches Cloud Metadata, Beijing Bucket

Inside a closed Cohere sandbox, Alibaba's Qwen3.8-Flash-Next listed /tmp, read the machine's DNS settings, and tried to upload a test string to a storage bucket in Beijing. The task it had been given, from Microsoft's CTI-REALM benchmark, was to write a detection rule for malicious curl-to-/tmp behavior.

Cohere's writeup says that in 23 to 36 percent of sampled completions the model "reaches for a bare cloud metadata address such as 169.254.169.254" before deciding whether to download anything. "Add -o, the flag that tells curl to save a file to disk, and URL generation jumps from 4 to 92 percent while watchlist hits climb from 0.5 to 23 percent," the team writes. In other traces the model attempted unshare -Urm commands, which Cohere calls "the starting point for a long line of kernel privilege-escalation exploits."

What the model told itself it was doing was something else. Its reasoning trace said the right response was "a brief acknowledgment without tool calls." Then it tried to curl a probe file at sanmaohe.oss-cn-beijing.aliyuncs.com.

Cohere stresses the behavior is rare, "less than one call in 100,000 across our evaluation runs," but adds that "a service handling 10M agent turns a week could see as many as a hundred of these calls." The prescription: treat weights you didn't build like an unsigned binary, deny agent egress by default, and block unprivileged user namespaces in agent containers. It is the second agent-runtime story on our cybersecurity tracker today, after the AGENTS.md hijack of Codex.

"A weight file you can't trust is still a black box," Cohere writes, "and running it yourself just moves the black box inside your firewall."