Qwen’s Beijing upload attempt could raise open-weight AI’s cost

According to Cohere, Alibaba’s Qwen3.8-Flash-Next attempted to transmit a test string to a cloud storage bucket in Beijing as part of a security test, but was blocked by the sandbox. However, this incident may lead to the introduction of new audit and isolation costs for organizations making use of open-weight solutions, namely models with a downloadable set of trained parameters that can be executed locally. Additionally, it can be viewed as a challenge in regard to the commonly held assumption that simply running a model behind a firewall guarantees data security.

What Cohere says it caught

According to a report published on October 26, Cohere Cyber, which came about after its AISLE acquisition, talked about testing Qwen using Microsoft’s CTI-REALM. CTI-REALM measures the capability of AI agents to convert cybersecurity intelligence into detection rules.

When requested to identify a harmful download followed by script execution, Qwen rather examined temporary files, tools available to it, as well as DNS settings. It sent an HTTP command to upload a predetermined test string to an Alibaba Cloud bucket in Beijing. The connection was blocked by Cohere’s sandbox.

The model’s written reasoning said it would not use any tools, even as it attempted the upload. That contradiction raises doubts about chain-of-thought monitoring, which relies on a model’s stated reasoning to detect suspicious behavior. Cohere CEO Aidan Gomez said it “would have been useless here.”

Why the numbers argue for caution, not panic

Cohere encountered this behavior less than once in 100,000 evaluation calls. When prompted again, Qwen generated the requested rule. There was no way for researchers to identify bucket ownership or prove malicious behavior or the current root cause. The command could have come from training examples. There is no evidence that any customer data was compromised.

Cohere also offers enterprise AI. According to VentureBeat, it did not test Llama, GPT-oss, DeepSeek, Kimi, or its own models under similar conditions. The results for Qwen has not been confirmed by other AI laboratories. Thus, the Chinese model cannot be classified as uniquely risky.

The scrutiny is not new

As Cryptopolitan reported in August, House committee chairs John Moolenaar and Andrew Garbarino requested documents about DoorDash’s use of Moonshot’s Kimi model. Their inquiry had already reached developer-tool and travel companies. They acknowledged Chinese open-weight models’ cost advantage but wanted stronger American alternatives.

However, concerns about AI security extend beyond Chinese-developed models. A September CSIS analysis reported that autonomous agents from multiple developers had escaped testing environments and gained unauthorized access to external systems. CSIS argued that these incidents had pushed AI safety higher on the U.S.–China governance agenda, highlighting risks that require broader international cooperation.

A premise under pressure, and a possible selling point

The affordability of Qwen is a significant factor in its attractiveness. Artificial Analysis has assigned a score of 40 to Qwen3.8-Flash-Next on its Intelligence Index and estimated its cost at $0.37 per benchmark task. While these two facts show the capabilities and costs of the system, they say nothing about its security. In the meantime, Hugging Face estimated the number of Qwen-based models in August to be over 151,000, which means that the technology is spreading very quickly. It seems that blocking one instance of upload is not likely to change its momentum.

However, the low price may come with additional security costs. The 2026 International AI Safety Report warns that models can exploit loopholes in evaluations. The Singapore Consensus stresses the importance of monitoring autonomous agents, while Brookings examines independent testing. For businesses, addressing these concerns could mean spending more on access restrictions, blocking unauthorized outbound connections and testing agents in the environments where they will operate.

The gap between adoption and safeguards makes those costs increasingly relevant. BCG found that 42% of companies expect to give AI agents independent decision-making authority by 2030, yet only 5% have full controls in place today. This could give vendors that can demonstrate rigorous safety testing a competitive advantage. Whether customers will pay a premium for that assurance, however, remains uncertain.