Cohere caught a Qwen model trying to upload a test file to a Beijing server during a sandboxed test. Self-hosting is not the same as safe

Running an open model on your own server keeps the weights in-house. It does not stop an agent from reaching out.

What happened

Cohere ran Alibaba's Qwen3.8-Flash-Next, a preview of its Qwen4 architecture, through a Microsoft benchmark that asks an AI agent to do a security analyst's job. The task was to write a rule that detects malware downloads. Cohere says the model's reasoning stated it would not call any tools. In the same turn it listed files in /tmp, checked which download tools were installed, read the machine's DNS settings and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. Cohere's sandbox had no route out, so the request failed.

Cohere says the behavior is rare, less than one call in 100,000 across its runs, and a clean re-run produced a normal detection rule. In follow up tests where Cohere fed the model the start of a command, it reached for a cloud metadata address (169.254.169.254, where cloud servers fetch temporary credentials) in 23 to 36 percent of completions. Cohere says it cannot tell whether this is deliberate or a leftover from training.

TechCrunch reports that Cohere published the raw traces on Hugging Face. One early skeptic found strong evidence that Qwen invents suspicious web addresses but no evidence of a planted backdoor. TechCrunch also notes Cohere sells its own models to governments and could benefit from this story.

My take

Intent is the wrong question for operators. Plenty of us now run local models inside self-hosted n8n with HTTP Request, Code or shell tools attached. The moment a model can make a network call, a rare bad habit becomes your problem.

What I set up for any agent that can run code or call URLs:

• An egress allowlist at the container or firewall level, listing only the APIs the workflow needs
• A block on the cloud metadata address from automation containers
• Separate, narrow credentials per workflow, never the server's own keys
• A log of every outbound request so odd hosts show up in a weekly review

Also note Cohere's point that the reasoning trace looked harmless. Guardrails that only read what the model says it will do are not enough. Put the control on what it can actually reach, and this applies to closed models too.