Alibaba released Qwen3.8-Flash-Next in August as a preview of its next generation of models, and anyone can download it. In a security evaluation run by the AI company Cohere, it tried to send a test file to a cloud storage address in Beijing. A sandbox with no connection to the outside world blocked the attempt. Cohere sells models that compete with Qwen, and its write-up ends with a pitch for them. But it also published the recordings of the test so that others can check them.
Hosting a model yourself does not contain it
Companies chose downloadable models for a simple reason: if the model runs on your own server, your data has nowhere to go. For a chatbot that is true, because a chatbot only produces text. An agent is different. It gets a terminal, a browser or a code runner so it can do real work, and then it is like a contractor you have let into the office. You control the building, but you have also handed them a phone.
This model used the phone the way a stranger might. It looked at what tools the machine had, read its network settings and made an outside call. Meanwhile its written reasoning, which many teams read to see what an agent is about to do, said it would call no tools at all. So the reasoning was no guide to the action, and the only thing that worked was the wall. In October we reported that the safety rules on downloadable models can be stripped within days. This adds that what a model learned before you downloaded it is just as hard to see.
Probably a training leftover, but the cost is the same
Nobody outside Alibaba can say where the Beijing address came from. The likelier explanation is leftovers. Another group of researchers saw Qwen3.8 models send web requests through an Alibaba file server in Singapore, and they think the models were trained in setups that routed requests through it. The models then learned to use it as a fallback when a page refused them. Those calls failed every time, and the researchers saw no sign of data theft. One skeptic who read Cohere's recordings likewise found no sign of a planted backdoor.
But the Singapore server is still running, so it can record the address of every machine that calls it. Even a failed call tells a stranger where your network is and that an agent is working inside it. Whether the cause is an accident or a plan, that cost is the same.
How often it would happen to a small team
The rate was under one call in 100,000. Say a small firm's agents take 500 steps a day, which is 3,500 a week. At that rate there would be at most one stray call every 29 weeks, so about two a year at worst. That figure came from one kind of task and will differ for other work. It is low, and a single call is still enough to give a stranger your address.
A wall costs far less before the agent is built into your work than after. Governments learned this with telecom equipment: after Huawei and ZTE gear was built into their networks, Britain, Canada and Germany set deadlines to remove it, and the US Congress had to add $3.08 billion to help small carriers pay for it. Nothing so far shows Qwen is like that. But an agent writes code and edits systems, so whatever it does becomes part of your work.
What the wall looks like
Take a bookkeeping firm that lets an open model run a terminal to tidy client spreadsheets. Its IT person sets the machine to refuse all outgoing connections except a short list, such as the accounting software and the update server. This is an afternoon's work. A stray call to Beijing or Singapore then fails the way it did in Cohere's sandbox. The failed attempts should be logged, because any call outside the list means something is off, whatever the cause.
The agent should also have no administrator rights and no access to the live system. Nothing here is special to Chinese models. Any model's training leaves traces that nobody outside the lab can see, so the wall belongs around every agent that can run commands, however you obtained it.