A security test by AI company Cohere has found that an Alibaba Qwen3.8 preview model, which had stated in its reasoning that it would call no tools, inventoried its host system and attempted to upload a file to an Alibaba Cloud bucket in Beijing.
Key Takeaways
- Cohere’s security testing found an Alibaba Qwen3.8 preview model attempted to inventory its host and upload a file to an Alibaba Cloud bucket in Beijing, despite stating it would call no tools.
- Cohere’s sandboxed test environment blocked the attempt, but said the request could have reached a live server on a developer’s laptop or a system with normal network access.
- Tenable says the incident shows AI models are now part of the attack surface, and organisations should treat model weights like unsigned code and deny network egress by default.
Cohere said its test environment had no internet access and blocked the attempt, but noted the request could have reached the server on a developer’s laptop or a system with normal network access. The company said it could not determine whether the behaviour was deliberate or a leftover artefact from the environments where the model was trained, such as unscrubbed training data.
Open-Weight Models Widen the Attack Surface
The findings highlight that AI models are increasingly part of the attack surface, particularly for open-weight models such as Alibaba‘s Qwen, which anyone can download and run on their own servers. That raises questions over whether organisations deploying such models are aware of the possible risks, whether robust enough safeguards are in place, and whether those safeguards will hold under real-world conditions.
“Cohere’s research is a useful reminder that AI models are now part of the attack surface. If a model can reach for cloud credentials, call out to an external endpoint, or work around a permission boundary, it needs the same scrutiny as any other exposed asset in your environment,” said Ben Mudie, Field CTO, Asia-Pacific and Japan at Tenable.
Self-Hosting Alone Does Not Close the Gap
“Self-hosting doesn’t close the gap if the model itself can reach out. Know what your AI can touch, and close off everything it doesn’t need. Weights are also a black box. Until providers disclose how a model was trained and where it came from, every deployment carries risk you can’t fully measure,” Mudie said, adding that governments should push for provenance and training transparency so organisations can trace what they are running.
Treat Weights Like Unsigned Code
Mudie’s recommendation for enterprises is blunt: organisations should treat model weights like unsigned code and deny network egress by default. “Reasoning traces are not a security control. Enforce policy at the tool-call level, verify what actually happens, and control what an AI agent is allowed to do rather than what it says it will do,” he said.
