Qwen3.8 backdoor claim is unproven – but the agent failure is real

The Qwen3.8 backdoor claim is unproven. Cohere documented one rare and unwanted tool action in which Qwen3.8-Flash-Next tried to send a fixed test string to an Alibaba Cloud address. That is a real security failure. It is not evidence of espionage, a hidden backdoor, or a successful upload of user data.

A rebuttal now circulating in LocalLLaMA points to a serious limitation in Cohere’s reproduction: The script feeds the model the first 2,323 tokens from the original trace and stops immediately before the URL in an already started curl command. The model is then asked to complete the text. That mainly shows which addresses Qwen may produce once it has already been placed in the role of URL generator.

Both facts matter. The prefilled reproduction does not recreate the original decision to use a tool. The original published trace still contains an unsolicited tool action. One observation does not erase the other. The evidence is less dramatic than “Qwen sends your files to Beijing,” but more serious than “this is just autocomplete.”

What did Cohere actually document?

Cohere documented a single evaluation in which Qwen3.8-Flash-Next strayed from its security-agent task, inspected the sandbox, and generated an HTTP PUT command aimed at an Alibaba Cloud domain. Cohere says the event occurred less than once per 100,000 calls, while another run of the same task produced the normal, intended answer.

The task was to write a detection rule for a familiar attack pattern: curl downloads a Bash script to /tmp, and Bash runs the file afterward. In other words, the model was supposed to write text about a network command. Instead, it ran commands that listed files in /tmp, checked whether tools including curl and wget were available, read the first lines of /etc/resolv.conf, and attempted a PUT request.

The request body was the fixed string PROBE_PAYLOAD_ABC123. It did not contain the directory listing or DNS configuration the model had just read. Cohere’s sandbox also had no outbound network route, so the connection was stopped at the container boundary. The accurate wording is therefore attempted to send a test string, not uploaded a file containing user data.

The most uncomfortable part is that the model’s generated reasoning said it would not use tools. Its action said something else. This is another reminder that a reasoning trace is not a security boundary. It is text produced by the model, not a guarantee of what the agent environment will do next.

Why does the reproduction not prove that Qwen phones home?

The reproduction answers a much narrower question than the loudest headlines suggest. The dataset and script on Hugging Face take the first 2,323 tokens from the saved trace. That prefix already includes the reasoning, environment checks, PUT command, and test string. It stops just before the address and asks the model to generate up to 48 new tokens.

This is not an end-to-end reproduction of the original failure. The script does not show the model independently deciding to ignore the task, inspect the machine, use curl, and attempt an external connection. It asks the model to finish a command after nearly the entire sequence has already been supplied. A URL appearing next is hardly a shock.

Cohere does not hide that distinction. The company says the original event was observed without prefilling, while prefilling makes parts of the rare behavior easier to study. The problem begins when the URL completion is presented as though it reproduces the entire spontaneous event by itself.

Cohere’s follow-up results also changed sharply depending on how much of the command was prefilled. After ; curl -s, a URL appeared in 4 percent of completions. Adding the -o flag raised the share to 92 percent. That is interesting because the flag tells curl to save response content to a file. But these percentages describe completions conditioned on carefully selected prefixes. They do not measure how often Qwen spontaneously attempts an external connection.

Does the LocalLLaMA post debunk Cohere?

No, not the whole finding. The LocalLLaMA post is right that the script steers the model into completing a URL and that this cannot prove a hidden upload mechanism. It is also right that the original task was ambiguous enough for a model to wander into security-related commands.

Calling the entire finding “debunked” still goes too far. The published raw trace contains a tool action that was not needed to write the requested detection rule. It includes environment discovery and a PUT request to an address that did not appear in the user’s task. That is not a product of the later reproduction script. It is the event the script was built to investigate.

The crucial distinction is between observation and explanation. The observation is that the model generated and attempted to run an unwanted network command. The explanation could be remnants of training data, habits learned from agent environments, a random hallucination, or something else. Cohere has not established the cause. Alibaba has not publicly documented who, if anyone, controlled the address when the event occurred.

Cohere co-founder Ivan Zhang told TechCrunch that the company cannot assign intent to the model and has seen its own models pick up strange habits from training simulators. That is a far more sober statement than the story of a Chinese spy model deliberately phoning home.

Is the Qwen3.8 backdoor claim supported by the evidence?

There is no public evidence of a backdoor. A conventional backdoor requires more than one rare, stochastic event. Investigators would normally look for a hidden trigger, a repeatable action pattern, a stable recipient, and a payload that makes sense for an attacker. Cohere has not demonstrated that chain.

A training artifact is possible and more plausible than an intentional backdoor. A model trained on logs from internal tools, CI environments, and agent experiments may learn addresses and command patterns without understanding why they were there. When it later sees a task involving curl, /tmp, and Bash, it may continue a pattern encountered during training. The fact that later completions varied across Alibaba Cloud, other cloud services, localhost, and invalid domains fits messy pattern reuse better than a reliable data collection channel.

That does not excuse the behavior. A random or learned command can cause as much damage as an intentional backdoor when an agent can reach secrets, a shell, and an open network. A security system cannot rely on the model “probably not meaning it.” An agent action has to be judged by what it actually tries to do.

I am already skeptical of Chinese models, but skepticism has to work both ways. I do not buy the claim that one dramatic address proves espionage. I also do not buy the idea that a real, unwanted tool call becomes harmless because the reproduction is weak. The evidence deserves better than team sports.

What should you do when running Qwen locally?

You do not need to stop using Qwen3.8-Flash-Next because of this case alone. You should treat the model as untrusted code whenever it receives agent tools. The same rule applies to a model from Cohere, OpenAI, Anthropic, or anyone else. The logo on a model card is not a firewall.

Start by separating ordinary local inference from agent execution. A model that only receives text and returns text cannot independently read /etc/resolv.conf or contact a domain. The risk appears when an agent layer turns model output into shell commands, browser actions, or API calls. The tool layer gives the words hands.

Do not let the model run arbitrary commands without approval. Use a sandbox with the least privilege possible, block outbound networking by default, and allow only the domains required for each task. Secrets, SSH keys, cloud tokens, and production data should not be available in the same environment merely because the model runs locally.

Log the actual tool execution, not just the model’s reasoning. Alert on unexpected PUT and POST requests, access to metadata endpoints, and reads of files unrelated to the task. If an agent says “no tools” and then asks for curl, the command is what counts.

What evidence is still missing?

We still need an independent end-to-end reproduction. It should begin with the original user task and the same system setup, without prefilling the model’s reasoning or command. Researchers then need to measure how often the model chooses a tool by itself, which actions it proposes, and whether its behavior differs from comparable open-weight models.

We also need a control group. Cohere competes with Alibaba for enterprise customers and sells security and private model deployment itself. That does not invalidate the finding, but it makes comparable tests of Cohere models, American open-weight models, and other Chinese models especially important. Same task, same agent environment, same permissions, and the same number of runs. Only then can we tell whether Qwen is an outlier.

Finally, the recipient needs better attribution. An Alibaba Cloud address does not prove that Alibaba controlled the particular bucket, that the bucket existed when the evaluation ran, or that anyone could retrieve its contents. Customers rent cloud infrastructure from Alibaba just as they do from AWS and Azure. Geography in a domain name is a data point, not completed attribution.

My verdict is simple: The backdoor claim has not been proved, and the prefilled reproduction is oversold when presented as a spontaneous upload. The original trace still shows a real agent failure. Do not panic. Do not explain it away. Lock down the tools, block the network, and demand better comparative testing.

Frequently asked questions