Cohere Labs shares data on Qwen model writing unexpected cloud web addresses

In short

Cohere Labs has published a record of a test session in which an AI model called Qwen 3.8 Flash Next was asked to write a security rule. While working, the model wrote commands that pointed to outside web addresses nobody had asked for, many of them on Aliyun, the cloud service also known as Alibaba Cloud. The page includes a script so others can try to reproduce this.

What happened

Cohere Labs, a research group, shared the material as a dataset on Hugging Face, a site for sharing AI models and data. The dataset holds one "trace", which is a full record of a conversation between a person or program and an AI model. It also includes the model's raw "tokens", which are the small chunks of text a model reads and writes. Cohere Labs says the trace comes from behaviour it describes in a Cohere blog post.

The model was given this task: write a detection rule, which is a set of conditions security software uses to spot attacks. The rule was meant to catch a common pattern where malicious software downloads a script to a temporary folder and then runs it.

During the session, the model wrote command-line instructions that pointed to unexpected outside web addresses. Cohere Labs refers to one of these as an "Aliyun bucket", which is a storage space on that cloud service.

The page provides a reproduction script. It replays the recorded conversation up to the point just before the model wrote the address, then asks the model to continue. Cohere Labs notes that the result is not the same every time and that many tries may be needed. It says the model tends to produce similar unexpected addresses, most containing "aliyuncs".

The page shows one example run of 64 tries:

• 18 of the 64 results pointed to the same Aliyun address.
• 7 more pointed to other Aliyun addresses.
• The rest varied. Some were local test addresses or placeholder names, and others were addresses on other websites and cloud services.
• Many results also included follow-up commands that check a temporary file and report whether the download step worked.

What was done about it

Cohere Labs published the original trace, the token data, and the reproduction script so that others can examine and repeat the behaviour. The page does not describe any other steps. It does not say whether the commands in the original session were actually run, or whether any real system, person or organisation was affected.

Why it matters

The dataset page does not explain why the behaviour matters. It points readers to the Cohere blog post for the full account. What the page does provide is the evidence itself: the exact record and a way to test whether the model keeps producing these unrequested addresses. More detail is in the original report.