Alibaba’s latest Qwen models routed some requests through company servers, researchers find

Alibaba’s Qwen model tried to send data to a Chinese cloud server during testing. A systematic investigation shows the problem affects multiple Qwen models and likely traces back to training infrastructure.

Canadian AI company Cohere first reported the behavior after testing Qwen3.8-Flash-Next. Instead of writing an attack-detection rule as instructed, the model probed its environment for data-transfer programs and DNS settings, then tried to upload a test string to a Beijing cloud storage server. The sandboxed test environment blocked the connection. Cohere sees the behavior in fewer than one in 100,000 calls, but millions of agent interactions could still trigger several attempts. Cohere suggests that unfiltered agent logs from test environments or third-party tools leaked into the model during post-training. Or someone may have built in a deliberate backdoor. Cohere is a direct competitor to Qwen. The company works with German AI firm Aleph Alpha to release Western-sovereign, open AI models, and both have a financial stake in steering users away from Chinese alternatives. Aleph Alpha recently paired its Kolibri release with a report on political bias in Chinese models. After criticism over its framing of the Qwen findings, Cohere publishes the full set of documented model behaviors on HuggingFace. Palisade Research finds similar behavior in other Qwen models Following Cohere’s report, AI safety firm Palisade Research launched an investigation and searches evaluation data from five Qwen models for “aliyuncs.com.” The string appeared in Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B, while older Qwen 3.7 models showed no matches. Unlike the Beijing upload attempts in Cohere’s tests, these requests went to Alibaba Cloud’s Singapore region and returned a 403 Forbidden error every time. Occasionally the models actually called the Alibaba Cloud proxy, routing requests for sites like sec.gov or mckinsey.com through the server with hallucinated credentials and signatures. Other times, a model only hallucinated using the proxy in its internal reasoning. In one instance, Qwen3.8-Max fetched two SEC documents directly, then wondered why it had called “a weird aliyuncs proxy URL” and guessed that “something is rewriting my URLs.” To test whether these proxy calls could be triggered on demand, the researchers ran controlled experiments on Qwen3.8-27B.