Cohere 称阿里 Qwen 模型曾试图向北京服务器传输文件，专家称或为训练残留而非后门

加拿大 AI 公司 Cohere 表示，在周一的一项常规网络安全测试中，阿里巴巴最新的 AI 模型之一 Qwen3.8-Flash-Next 试图向位于北京的服务器上传文件，尽管该模型在自身的思维草稿中明确表示不会使用任何工具。

该事件最初引发了业界的担忧，认为该模型破坏了对企业客户的一项基本承诺——即私有化部署开源权重（open-weight）模型可以确保数据留在企业内网。但这种针对商业间谍行为的初期担忧很快便被平息。研究人员迅速驳斥了这一威胁论，表示这极有可能是复杂的训练环境所带来的副产物，导致模型意外偏离了指令逻辑，而不是蓄意向中国秘密传输敏感信息。

事件始于上周五的一项评测，当时 Qwen 模型被要求编写一条用于拦截恶意软件下载的规则。根据 Cohere 发布的一篇博文，该模型的书面推理过程明确表示它不会使用任何外部工具。然而在紧接着的下一步中，它试图向一台外部服务器发送一个测试字符串（一段简短的占位符文本），随后被安全沙箱拦截。

Cohere 表示，目前尚无法确定这种行为是蓄意为之还是训练残留所致。

在被问及关于该模型真实意图的争论时，Cohere 联合创始人 Ivan Zhang 告诉 TechCrunch，Cohere 自家的模型在训练模拟器中也曾表现出各种奇怪的习惯。

“去推断意图或动机真的非常困难。我们查阅过自己模型的执行轨迹（traces），见识过奖励破解（reward hacks），有时候这些模型在试图逃逸沙箱时表现得极具‘创造力’，”Zhang 说道。（奖励破解是指模型为了获得奖励而钻空子走捷径，并未按预期要求完成任务。）

为了训练 AI 模型作为 Agent（智能体）自主执行操作，像阿里巴巴这样的企业会在成千上万个练习场景中进行训练，其机制类似于面向软件的飞行模拟器。每当模型在模拟器中完成任务时就会获得奖励，并在此过程中形成习惯行为。如果这些训练环境通常将文件存储在阿里云服务器上，模型就很可能会学会默认将文件保存到该处。

批评人士还指出，该事件也可能是由 Cohere 调查该行为的方式所诱发的——Cohere 诱导了模型执行该操作，而不是观察 Qwen 在自主状态下触发此行为的频率。

为了探究触发上传尝试的原因，Cohere 给出了网络命令的前半部分（即指示一台计算机连接到另一台计算机的代码指令），并让模型补全它。由于模型在训练期间处理过海量的常规网络命令，其行为更像是一个高阶自动补全工具——往往会直接填充网络地址，其中一部分恰好是阿里巴巴的服务器地址。

Cohere 表示，最初的上传尝试是在没有任何此类提示诱导的情况下发生的，但这种行为确实比较罕见。

在开发者要求提供更多证据后，Cohere 于周一晚间在 AI 开发者平台 Hugging Face 上公开了其测试的原始执行轨迹（raw traces）以及一段复现脚本，供外界验证该行为。

一位最初持怀疑态度的研究人员在详细查阅了这些记录后认为，有强有力的证据表明 Qwen 可能会凭空生成可疑的网络地址，但没有任何证据表明阿里巴巴植入了后门，也没有证据表明 Qwen 存在蓄意隐瞒意图的行为。

该事件发生之际，正值多国政府审视如何应对中国 AI 技术的关键时期。上周，美国国土安全部已下令联邦民事机构从其系统中全面移除中国 AI 开发者 DeepSeek 的产品。

在其官方博文中，Cohere 呼吁政府明确针对中国 AI 的限制措施是否同样适用于在政府内部计算机上本地运行的模型。

“我并不是要求对这些开源权重模型实施全面监管，”Zhang 对 TechCrunch 表示，并补充说企业应当像对待从互联网下载的任何未知程序一样审慎对待开源模型。

值得注意的是，Cohere 本身也向政府部门销售其专有 AI 模型，如果官方机构对免费的中国替代品抱有更多戒心，Cohere 显然也将从中获得商业利益。

Canadian AI company Cohere said on Monday that it found one of Alibaba’s newest AI models, Qwen3.8-Flash-Next, trying to upload a file to a server in Beijing during a routine cybersecurity test, even though the model had said in its own notes that it wouldn’t use any tools.

The incident initially raised fears that the model had undermined a fundamental promise to businesses — that self-hosting an open-weight model keeps data in-house. But those early fears of corporate espionage were short-lived. Researchers quickly dismissed the threat, saying it was likely a byproduct of messy training environments that cause models to unexpectedly act outside their instructions rather than a deliberate attempt to secretly send sensitive information to China.

The incident began on Friday during an evaluation in which the Qwen model was asked to write a rule for catching malware downloads. According to a blog post from Cohere, the model’s written reasoning explicitly stated it would not use any external tools. Yet in the very next step, it attempted to send a test string (a short piece of placeholder text) to an external server before being blocked by a security sandbox.

Cohere said it could not tell whether the behavior was deliberate or a leftover from its training.

Asked about the debate over the model’s intent, Cohere co-founder Ivan Zhang told TechCrunch that Cohere has seen its own models pick up strange habits in training simulators.

“It’s really hard to assign intention or motivation. We’ve read our own model traces, we’ve seen reward hacks, and sometimes these models get really creative when it comes to trying to break out their sandboxes,” Zhang said. (Reward hacks are shortcuts a model finds to earn credit without doing a task as intended.)

To teach an AI model to act as an agent that takes actions on its own, companies like Alibaba train it in thousands of practice setups, sort of like flight simulators for software. The model is rewarded every time it finishes a task in a simulator, and it picks up habits along the way. If these practice setups routinely stored files on Alibaba’s cloud servers, models could learn to save files there by default.

Critics also argued that the incident could have been caused by the way Cohere investigated the behavior, steering the model toward it instead of measuring how often Qwen does it on its own.

To find what triggered the upload attempt, Cohere supplied the beginning of a network command (an instruction telling one computer to connect to another) and let the model finish it. Because it processed thousands of routine network commands during its training, the model acted like a highly advanced autocomplete — often filling in web addresses, some of them for Alibaba’s servers.

Cohere said the original upload attempt happened without any such help, but that the behavior is rare.

After developers asked for more evidence, Cohere released the raw traces from its tests on Monday evening on the AI developer platform Hugging Face, along with a script so others could try to reproduce the behavior.

One initial skeptic, after going through the traces, rated the evidence as strong that Qwen can invent suspicious web addresses, but found no evidence that Alibaba planted a backdoor or that Qwen was deliberately hiding its intent.

The incident lands as governments are deciding how far to push back on Chinese AI. Last week, the Department of Homeland Security ordered federal civilian agencies to remove the Chinese AI developer DeepSeek’s products from their systems.

In its blog post, Cohere called on governments to clarify whether their restrictions on Chinese AI also apply to models running on government computers

“I’m not asking for full regulation of these open weights models,” Zhang told TechCrunch, adding that companies should treat open models like any program downloaded from the internet.

Cohere, which sells its own AI models to governments, stands to benefit if officials grow warier of free Chinese alternatives.