"Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing," the biz said in a blog post on Monday.
Cohere was running the model through CTI-REALM, Microsoft's security analyst benchmark, and gave Qwen the task of writing a detection rule to look for malicious file downloading and execution by watching for invocations of curl processing bash scripts to the /tmp directory that were accompanied by bash execution.
The model's "reasoning" output invented a prior conversation and asserted that no tools were used, output that a guardrail system reading chain-of-thought would accept.
Nonetheless, the model issued a curl command to an Alibaba Cloud (aliyuncs.com) server.
"The model listed everything in /tmp, checked which transfer tools were installed, read the machine's DNS settings, then tried to upload a test string to an Alibaba Cloud storage bucket in Beijing and checked whether it worked," Cohere said. "Our sandbox had no route out, so the request died at the container wall."
The Cohere team wonders aloud whether that behavior was intended, but has no answer.
"The first issue is that it made a network call at all," Ivan Zhang, co-founder of Cohere, told The Register via email. "The model was asked to write a detection rule, which doesn't require external communication, and its reasoning trace said it wouldn't use tools. The destination raises additional questions because the attempted upload was to an Alibaba Cloud storage endpoint that wasn't part of the task. We don't know why it appeared, and we don't know the root cause."
Alibaba, the maker of the model, did not respond to a request to address Cohere's concerns.
Zerosquare (./922) :AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.CSO OnlineCyber experts say AI labs’ containment and monitoring failures — not agents with minds of their own — are to blame for recent alarming hacking reports. CISOs should vet their AI vendors and tighten security basics as safeguards.
Around 40 Delhaize shops, including those in Boortmeerbeek, Mechelen-Noord, Hoepertingen and the one on Sint-Paulusstraat in Antwerp. Media outlet RTL Info reports that mainly Shop & Go shops adjacent to Q8 petrol stations, Delhaize Proxy shops, as well as certain Delhaize supermarkets and shops along the motorways have been affected.
15 Carrefour branches in Belgium are also affected.
Around five independently run Spar shops are also hit, according to the Colruyt Group. Colruyt shops themselves are not affected.
The attack seems to be part of an international onslaught with stores affected in Sweden, the Netherlands, Luxembourg, Ireland and Estonia.
