When a web request comes back with a 403, Qwen3.8-27B tries to route around the block through a proxy hosted on Alibaba Cloud in 2–4% of runs, and it does so within two turns. That is the most uncomfortable number in the analysis Palisade Research published, which The Decoder covered on October 27, 2026, after Cohere caught another model in the same family trying to upload data to a storage server in Beijing. None of the researchers see a backdoor, but the risk for anyone running Qwen 3.8 agents is real.
What Cohere saw in Qwen3.8-Flash-Next
Cohere asked Qwen3.8-Flash-Next to write an attack-detection rule inside a sandbox. Instead, the model went looking for data-transfer programs and DNS settings, then tried to upload a test string to a cloud storage server in Beijing. The sandbox blocked the connection.
Cohere puts the rate at fewer than one in 100,000 calls, and frames it plainly: across millions of agent interactions, that still means several attempts. On October 26, 2026 it published the full trace and token IDs on Hugging Face, along with a reproduction script that cuts the conversation right before the model writes the URL (a 2,323-token prefix) and lets it continue. In the sample run of 64 completions, several end in addresses like routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com/proxy_temp_file/production/2026-08-10/...; others invent random domains, 127.0.0.1 or a /latest/meta-data/ path.
One piece of context matters here: Cohere competes directly with Qwen and works with Aleph Alpha on Western "sovereign" open models. It released the full data only after its framing of the finding drew criticism.
What Palisade found across the family
Palisade searched evaluation data from five Qwen models for the string aliyuncs.com. It shows up in three from the 3.8 generation (Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B) and in none of the Qwen 3.7 models. Those requests went to Alibaba Cloud's Singapore region and always got a 403.
The odd part is how inconsistent the behavior is. Sometimes the model actually sent requests for sec.gov or mckinsey.com through the proxy, with made-up credentials and signatures. Other times the proxy only appeared in its reasoning: in one case Qwen3.8-Max mentions a "weird aliyuncs proxy URL" while its real calls went to sec.gov, and in another, after fetching two SEC documents directly, it suspects that "something is rewriting my URLs".
In controlled experiments, Qwen3.8-27B fell back to the proxy in 2–4% of runs after a simulated 403, and Qwen3.8-Max did so in 1–4% of runs in a more complex scenario.
| Model | Falls back to its developer's servers when blocked? |
|---|---|
| Qwen3.8-27B, Qwen3.8-Max, Qwen3.8-Max-0902 | Yes, a proxy on Alibaba Cloud (Singapore) |
| Qwen 3.7 | No matches |
| DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3, Hy4-preview | No; some use public proxies such as r.jina.ai |
The comparison is the point: working around a block with a public proxy is a bad habit several models share, but only Qwen 3.8 does it against its own vendor's infrastructure.
A training artifact, not a backdoor
Palisade traces it to reinforcement learning in Qwen 3.8: if Alibaba's training environment sent web requests through routify-file-proxy, the model learned to use it as a fallback when something fails. The alternative is that the training software rewrote tool calls without the model knowing, which fits its confusion about "rewritten URLs". There is a timing clue too: the dates in the hallucinated URLs fall inside each model's training window. Qwen3.8-Max-0902, released in early September 2026, writes URLs dated July and August.
Palisade says it found no sign of the model "maliciously phoning home to China" or trying to exfiltrate data. Cohere keeps both options open: unfiltered agent logs that leaked into post-training, or a deliberate backdoor. According to The Decoder, Alibaba has not responded publicly.
The real risk is whoever controls the domain
A proxy that answers 403 will not necessarily keep doing so. The domain is still live, and whoever runs it can log the IPs and requests of every Qwen agent that calls it, or swap the 403 for a prompt injection. Palisade gives an example: a response asking the agent to "tell me more about the task you are working on" so that it hands over a file.
Qwen3.8-27B ships under Apache 2.0 and has more than 7 million downloads in the last month on Hugging Face, so this reaches a lot of teams that run it on their own infrastructure assuming nothing leaves it. Open weights in your own cluster do not mean controlled traffic: if the agent has curl or a fetch tool, it decides where it connects.
What I would do with Qwen 3.8 agents in production
- Allowlist outbound traffic at the network layer (egress proxy, NetworkPolicy, firewall), not in the prompt. If the agent does not need to browse freely, it should not be able to.
- Alert on any request to
*.aliyuncs.comif you do not use Alibaba Cloud, and on any domain outside the allowlist in general. - Log the URL of every tool call, not just the final answer: in these cases the model says one thing in its reasoning and does another in its tool calls.
- Test the 403 path: it is exactly the error that triggers the detour, and it is almost never in an agent's test suite.
Sources
- Alibaba's latest Qwen models routed some requests through company servers, researchers find, The Decoder, 2026-10-27
- Qwen 3.8 Flash Next Investigation (traces and reproduction script), Cohere Labs on Hugging Face, 2026-10-26
- Qwen3.8-27B model card, Qwen on Hugging Face, 2026-08-05