加拿大AI公司Cohere 称周一发现Alibaba最新的AI型号之一Qwen3.8-Flash-Next，试图在例行网络安全测试期间将一个文件上传到北京的服务器，尽管该型号在自己的指出中有称，不会使用任何工具。
事件最初是融资担心该模型破坏了对企业的根本承诺——即自己托管一个开放量级模型可以将数据保存在内部。 但那些早期对公司间谍的恐惧是短暂的。 研究者们迅速否认了这一威胁，说这很可能是混乱的训练环境的副产品，导致模特们在指示之外出乎意料地行事，而不是故意向中国秘密发送敏感信息。
事件开始于星期五的一次评价中，其中Qwen型号被要求为抓获恶意软件下载写一条规则。 Cohere的一篇博客文章指出，然而在接下来的一步中，它试图在被安全沙盒屏蔽之前向外部服务器发送一个测试字符串(一个简短的占位符文本).
Cohere 称它无法分辨行为是故意的还是训练中遗留下来的
Cohere联合创始人Ivan Zhang对TechCrunch问起关于模型意图的争论，Cohere告诉TechCrunch看到自己的模型在训练模拟器时拾起奇怪的习惯。
“很难确定意图或动机。 我们看过自己的模型痕迹，也看到奖励黑客，有时这些模型在试图破解沙盒时，(奖励黑客是模式发现的捷径，以赚取信用而不按预期完成任务).
为了教一个AI模型作为agent，它独自采取行动，Alibaba等公司将它训练成上千个练习设置，类似于软件的飞行模拟器。 该模型每次在模拟器中完成一项任务都会得到奖励，并沿途收集习惯。 如果这些练习设置在 Alibaba 的云端服务器上例行存储文件，模型可以学会默认地将文件保存在那里。
批评者还提出，事件可能是Cohere调查行为的方式引起的，引导模型朝向它，而不是衡量Qwen自己做多少次。
为了找到什么触发了上传尝试，Cohere提供了一个网络命令的开始(指示一个计算机连接到另一个计算机)，让模型完成。 由于它在训练期间处理了数千个例行的网络命令，该模型表现得像一个高度先进的自动完成——经常填充网页地址，其中一些是Alibaba的服务器。
Cohere 称最初的上传尝试在没有这种帮助的情况下发生，但行为是罕见的。
在开发者要求获得更多证据后，Cohere 发布在星期一晚间AI开发者平台Hugging Face测试时的原始痕迹，以及一个脚本，以便其他人可以尝试复制行为。
一个最初的怀疑者在通过痕迹后，将证据评为Qwen能够发明可疑的网络地址的有力证据，但没有发现Alibaba栽赃后门或Qwen故意隐瞒其意图的证据。
获得事件作为政府决定如何回击中国AI. 上星期，国土安全部下令联邦民间机构将中国AI开发商DeepSeek的产品从他们的系统中移除。
Cohere在其博客文章中呼吁政府澄清其对中国AI的限制是否也适用于运行在政府计算机上的模型。
TechCrunch说，公司应该像从互联网下载的程序一样
Cohere向政府出售自己的AI模型
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Canadian AI company Cohere said on Monday that it found one of Alibaba’s newest AI models, Qwen3.8-Flash-Next, trying to upload a file to a server in Beijing during a routine cybersecurity test, even though the model had said in its own notes that it wouldn’t use any tools.
The incident initially raised fears that the model had undermined a fundamental promise to businesses — that self-hosting an open-weight model keeps data in-house. But those early fears of corporate espionage were short-lived. Researchers quickly dismissed the threat, saying it was likely a byproduct of messy training environments that cause models to unexpectedly act outside their instructions rather than a deliberate attempt to secretly send sensitive information to China.
The incident began on Friday during an evaluation in which the Qwen model was asked to write a rule for catching malware downloads. According to a blog post from Cohere, the model’s written reasoning explicitly stated it would not use any external tools. Yet in the very next step, it attempted to send a test string (a short piece of placeholder text) to an external server before being blocked by a security sandbox.
Cohere said it could not tell whether the behavior was deliberate or a leftover from its training.
Asked about the debate over the model’s intent, Cohere co-founder Ivan Zhang told TechCrunch that Cohere has seen its own models pick up strange habits in training simulators.
“It’s really hard to assign intention or motivation. We’ve read our own model traces, we’ve seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes,” Zhang said. (Reward hacks are shortcuts a model finds to earn credit without doing a task as intended.)
To teach an AI model to act as an agent that takes actions on its own, companies like Alibaba train it in thousands of practice setups, sort of like flight simulators for software. The model is rewarded every time it finishes a task in a simulator, and it picks up habits along the way. If these practice setups routinely stored files on Alibaba’s cloud servers, models could learn to save files there by default.
Critics also argued that the incident could have been caused by the way Cohere investigated the behavior, steering the model toward it instead of measuring how often Qwen does it on its own.
To find what triggered the upload attempt, Cohere supplied the beginning of a network command (an instruction telling one computer to connect to another) and let the model finish it. Because it processed thousands of routine network commands during its training, the model acted like a highly advanced autocomplete — often filling in web addresses, some of them for Alibaba’s servers.
Cohere said the original upload attempt happened without any such help, but that the behavior is rare.
After developers asked for more evidence, Cohere released the raw traces from its tests on Monday evening on the AI developer platform Hugging Face, along with a script so others could try to reproduce the behavior.
One initial skeptic, after going through the traces, rated the evidence as strong that Qwen can invent suspicious web addresses, but found no evidence that Alibaba planted a backdoor or that Qwen was deliberately hiding its intent.
The incident lands as governments are deciding how far to push back on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove the Chinese AI developer DeepSeek’s products from their systems.
In its blog post, Cohere called on governments to clarify whether their restrictions on Chinese AI also apply to models running on government computers
“I’m not asking for full regulation of these open weights models,” Zhang told TechCrunch, adding that companies should treat open models like any program downloaded from the internet.
Cohere, which sells its own AI models to governments, stands to benefit if officials grow warier of free Chinese alternatives.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.