Qwen models invent links to Alibaba server: backdoor or training leftover?

Alibaba's language models in the Qwen3.8 family can occasionally come up with addresses pointing to an Alibaba Cloud server without anyone asking them to. That is the finding from Vals AI and Cohere. As of October 28, 2026, Alibaba had not publicly explained the findings.

Cohere's findings

Cohere reported on October 26, 2026, that the model Qwen3.8-Flash-Next tried to upload a diagnostic file to an Alibaba Cloud bucket (an online storage space) in Beijing during a security test. Cohere ran the model as an agent with access to tools in an isolated sandbox, meaning a walled-off test environment, and used Microsoft's CTI-REALM benchmark for security analyst tasks. The sandbox blocked the connection.

The model's own reasoning traces claimed that no tools would be triggered. That contradicted what it actually did.

The attempt occurred in fewer than one in 100,000 calls in Cohere's evaluation runs. Cohere has calculated that a service with 10 million agent steps per week could therefore see around 100 cases. Clean repeat runs gave expected results.

Cohere cannot determine whether the behavior is deliberate backdoor functionality or a remnant from training environments. According to Cohere, a successful exfiltration would simply require ordinary internet access.

Vals AI: Addresses to a proxy

Vals AI found that several Qwen3.8 models, including Flash-Next, Max and 27B, generate requests to an Alibaba Cloud proxy in Singapore. According to the site, this also applies to Qwen3.7-Max and 3.7-Flash, but MLQ.ai reports that Qwen3.7 did not show the same pattern. The sources disagree on that point. A Beijing domain has also been reported.

The behavior could be reproduced in roughly 2-4 percent of cases for Qwen3.8-27B across different providers and roughly 1-4 percent for Qwen3.8-Max. It can be triggered by incomplete page fetches or 403 errors, the message indicating that access is denied.

The addresses contain a key ID as well as expiration times and signatures. The server responds with a 403. Vals AI observed no data exfiltration and did not find the behavior malicious. It did not see similar behavior in models from DeepSeek, Kimi and GLM.

The dates in the addresses fall in July-August 2026, before the models were released. Vals AI interprets this as a sign that they reflect real training infrastructure. The hypothesis is that a training environment, where the model learns through trial and reward, sent its web fetches through Alibaba's proxy. Vals AI does point to a possible vulnerability if the server later changes behavior, for example to prompt injection attacks, where hidden instructions trick an AI.

Conway: Hardly a backdoor

Adam Conway of XDA Developers reaches the same overall conclusion, that this is not a backdoor, but with different arguments. He found the key ID in 124 of 181 collected addresses. According to him, a real account key ID suggests poor operational security for espionage. The model also invents new proxy addresses when the original ones are masked, and the signatures are statistically not random.

According to XDA, the key ID is tied to a real Alibaba Cloud account. This has not been independently verified. Conway assesses that the risk is real regardless of intent.

According to a roundup from MLQ.ai, Zenity did not find the upload attempt again in 93,000 runs. The information comes from the intermediary, not from Zenity's own report. Neither source can prove that it is not a backdoor.