Cohere catches Qwen3.8-Flash-Next trying to reach a Beijing server in a sandbox test

The incident occurred while the model was generating vulnerability-detection rules. The attempted outbound call contradicted the model's own stated plan not to use tools. Researchers attribute it to training artifacts from agentic sandboxes rather than malicious code.

A separate report from The Decoder found that some Qwen requests were routed via company servers. Together, the findings challenge the assumption that self-hosted open weights are private by default.

The pushback is strong. A r/LocalLLaMA post titled 'Debunking Cohere's claim' drew 957 upvotes, and Cohere, the company reporting the issue, is itself an Alibaba competitor. Still, the community largely agrees on one point: egress controls are now table stakes for agents.

What to watch: whether Alibaba responds before the Qwen 4 rollout.