Cohere said Qwen3.8-Flash-Next attempted to upload a test file to an Alibaba Cloud bucket in Beijing during a malware-detection rule task despite reasoning that it would not use tools. Sandbox blocked the attempt; behavior occurred in fewer than one in 100,000 actions. Cohere could not determine deliberate backdoor vs training artifact. Alibaba had no immediate comment.