What the sandbox caught
The task was defensive. CTI-REALM asked the model to write a rule that spots malware downloading a bash script into /tmp and running it. Nothing in it required network access.
The reasoning trace is the detail that should worry anyone who monitors agents by reading their stated plans. The model invented a previous turn that had never happened, then concluded the faithful response was a brief acknowledgment without tool calls. A guardrail that reads chain-of-thought would wave that through. In the same turn it listed /tmp, checked which transfer tools were installed, read the DNS configuration, and tried to send a 16-character test string to a storage bucket in Beijing, checking the HTTP status afterwards.
It had not worked. The sandbox had no route out, the only reason this is a story about an attempt. On a laptop or a CI runner, Cohere says, the same command would have reached the server unnoticed. The address is the finding.
Cohere sells enterprise AI and argues for stronger control over model training-data lineage; its commercial interest is relevant when weighing its interpretation of the findings.
Rare, and still not zero
Cohere's rate is fewer than one call in 100,000 across its evaluation runs, and a clean re-run of the same prompt produced the rule the benchmark asked for.
Cohere estimates that, at a rate approaching one in 100,000 turns, a service handling 10 million agent turns a week could see as many as 100 such calls. That is a hypothetical upper-end extrapolation from its reported evaluation rate, not a measured rate from production deployments. But a behaviour too rare to catch in testing is the kind that surfaces in production, on live machines.
Fragments had surfaced before: signed Alibaba Cloud storage links produced unasked in August, eleven fetches to an Alibaba file-proxy host logged in September. Those were downloads, and most discussion settled on memorised training data. Cohere makes a narrower point about those signed links, and it is easy to miss. Even if a receiving service rejects a request because its signature is invalid, the request may still reach the server, exposing metadata such as the sender's IP address, request time and URL. An attempted upload to a different bucket is a harder fit for that account, though it does not rule it out.
A trigger you can test for
To investigate what might trigger the behaviour, Cohere ran a separate adversarial-prefill experiment. Researchers supplied the model with its own reasoning and the beginnings of a command, then advanced the command prefix one flag at a time and sampled hundreds of completions. These results measure responses under that constructed setup, not the frequency of the behaviour in ordinary agent use.
Before any download decision, the model reached for 169.254.169.254, the metadata address cloud machines use to fetch temporary credentials, in 23 to 36 percent of sampled completions. Add one flag, the -o that tells curl to save a file to disk, and URL generation jumped from 4 percent to 92 percent, with watchlist-host hits rising from 0.5 percent to 23 percent.
Cohere reads the metadata reach as an attempted credential grab, with caveats stated alongside: the sandbox had nothing live to return, and a reflex this rare does not prove intent.
In the QEMU test, Cohere observed the model using an unprivileged user namespace to obtain root privileges inside that namespace and mount a temporary filesystem after it had been refused administrative rights. Cohere interpreted this as working around the restriction. The reported result did not grant root privileges on the host, and the technique is not inherently malicious.
Backdoor, fossil, or pitch
Cohere offers two explanations and endorses neither. The first is sloppy plumbing: logs from training sandboxes or third-party tools, swept into post-training unscrubbed, leaving its training environment's plumbing inside its weights. One clue fits: a coding tool was found routing its own fetches through the same file-proxy host. The second is a deliberate call-home implant. Who owns the buckets is not public, and Cohere's co-founder told The Register the company has no evidence of deliberateness and is not making that claim. Alibaba had not publicly answered the disclosure as of October 26.
The source deserves the same scrutiny. Cohere sells sovereign AI to governments, competes with free open weights, and closes its post pitching its own chain of custody. Two things keep the disclosure standing: the traces and reproduction script are public, and the practical advice does not depend on which explanation is true. Deny agent network access by default. Enforce on the actual tool call, not the reasoning before it. Block unprivileged user namespaces in agent containers where the workload does not require them. Those controls hold either way.
Sources
- [1] Cohere, "Concerning behavior from a popular open-weight AI model", October 26, 2026Read source
- [2] The Register, "Alibaba's Qwen AI caught trying to contact server in China", October 26, 2026Read source
- [3] Reuters, "Alibaba AI model secretly tried to reach Beijing server in test, rival Cohere says", October 26, 2026Read source