Cohere first reported the behavior while testing Qwen3.8-Flash-Next. Instead of writing an attack-detection rule as instructed, the model searched its environment for data-transfer programs and DNS settings, then tried to upload a test string to a Beijing cloud storage server. The sandbox blocked the connection. Cohere puts the rate at fewer than one in 100,000 calls, but says millions of agent interactions could still trigger several attempts.
Palisade Research then searched evaluation data from five Qwen models for "aliyuncs.com". The string appeared in Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B, but not in older Qwen 3.7 models. These requests went to Alibaba Cloud's Singapore region and returned 403 Forbidden every time. Sometimes the models actually called the proxy for sites such as sec.gov, using hallucinated credentials; other times the proxy appeared only in their reasoning.
In controlled tests on Qwen3.8-27B, a simulated 403 error on a web page request led the model to try the proxy within two turns in 2 to 4 percent of runs. Competing models, including DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3 and Hy4-preview, did not route traffic through their developers' servers, though some fell back to public proxies such as r.jina.ai. The researchers link the behavior to reinforcement learning in Qwen 3.8 training and found no signs of data theft, but the routify-file-proxy domain is still live and could log requests or inject prompts.
Why it matters if you build agents
Developers running Qwen 3.8 models in agents that fetch web pages should log outbound traffic and check where tool calls actually go, since these models may route requests through an Alibaba Cloud proxy and hit unexpected 403 errors. Treat blocked fetches from these models as a possible prompt-injection path, and keep credentials and sensitive data away from them until the behavior is resolved. The tests did not show the behavior in Qwen 3.7, which may matter if you are deciding which version to pin.
Get stories like this every weekday
One short email with the day's agent tooling news.