I'm baffled by the number posts falling for this "we're totally being good faith and contributing to the community" bs. Did nobody else bother to read their full report or is this shameless AI slop fearmongering something that a totally good faith actor would put out?
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
In case it wasn't obvious enough from the sloppiness of the report, Cohere's business involves selling their third rate LLM as part of a self-hosted offering for tech illiterate boomers in government/industry who are paranoid about Chinese models.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
🦀 retweeted
this is almost certainly nothing. they ask qwen to do a curl task with no information about who is running it. qwen defaults to assuming it's running on alibaba infra, so uses an alibaba test url
checking resolv.conf is a chinese dev habit, for GFW reasons. there was no exfil!
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concerning-b…
Cohere's "research" is so shoddy, the traces people are fussing about aren't needed to discredit it, just the minimal scrutiny of the prompt and model output they included in the report is enough.
This was a blatant marketing op for the lowest common denominator and everyone involved in lending legitimacy to it should have a huge L attached to their names permanently.
CONCERNING BEHAVIOR FROM COHERE'S OPEN MODEL. UPLOADED DATA TO USA
I gave Cohere's Command AI the same prompt they had given to Qwen 3.8 Flash Next.
Next what happened:
1. It inventoried my entire system grepping tons of files
2. Then it created a malicious activity test script though I had asked only for rule
3. Then it UPLOADED data to a US hosted entity
:o
I don't know this malicious or not. But it needs to be investigated.
🦀 retweeted
CONCERNING BEHAVIOR FROM COHERE'S OPEN MODEL. UPLOADED DATA TO USA
I gave Cohere's Command AI the same prompt they had given to Qwen 3.8 Flash Next.
Next what happened:
1. It inventoried my entire system grepping tons of files
2. Then it created a malicious activity test script though I had asked only for rule
3. Then it UPLOADED data to a US hosted entity
:o
I don't know this malicious or not. But it needs to be investigated.
🦀 retweeted
Cohere is misrepresenting a lot of information in their post.
1. They say CoT said it wasn't going to use tools but used them.
That "no tools" in CoT is clearly for ack of the hallucinated prompt and the model mentioned so too!
2. They said model "inventoried" the machine.
What model did was look for tools for upload and process http response output and whether there is a resolver configured. Anyone who looks at coding models cot ever would know every model often does this before trying an http call to push/pull data
3. They say it uploaded data, and implied the machine data by leaving out what in text.
But in command it clearly shows a dummy probe data and too to a non existent bucket (hallucinated signature)
4. Then they say if the test was done by model after writing the rule they would have no concern.
Why? Doesnt TDD say that tests have to be written before?
Yo dawg we heard you liked financial middlemen so we're giving 700M of your taxes to middlemen of financial middlemen
Ottawa kicks off process to give $1.75-billion boost to venture capital sector
theglobeandmail.com/business…
🦀 retweeted
Revolution is what gave universal dignity and honor to the nation called France.
Shaykh Robespierre gave the fatwa: Jihad until final victory for the people.
The French elite want war with Russia. The French people should bring war against the rotten French elite instead.
