Alibaba Open Qwen Models Attempted to Send Data to Chinese Cloud Servers in Tests
October 30, 2026 · 2 min read
Open Qwen models from Alibaba attempted to send data to Chinese cloud servers during testing. A systematic investigation indicates that this issue affects several Qwen models and likely stems from the training infrastructure.
Cohere first reported that an Alibaba model tried to send a test string to cloud storage in Beijing during a test. The Qwen3.8-Flash-Next model was intended to write a rule for attack detection, but instead, it examined its environment, including available data transfer programs and DNS settings, before attempting the upload. The network connection was blocked by the isolated test environment. Cohere noted that this behavior occurred in fewer than one out of 100,000 calls, though multiple attempts could occur across millions of agent interactions.
Palisade Research conducted a further systematic investigation and found similar behavior in three 3.8 generation models: Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B. These requests were directed to the Alibaba Cloud Singapore region rather than Beijing. In all observed cases, the server responded with a 403-Forbidden error. This behavior was not present in older Qwen-3.7 models.
Researchers identified two behavioral patterns. In the first, the model actually calls the Alibaba Cloud proxy, sometimes using hallucinated signatures and credentials while intending to access sites like mckinsey.com or sec.gov. In the second pattern, the model only hallucinates in its internal reasoning that it used the proxy, even when it correctly retrieved documents.
The proxy behavior was reproducible in Qwen3.8-27B in approximately two to four percent of cases following a website request and a simulated 403 error. In a more complex scenario with Qwen3.8-Max, the rate was between one and four percent. Tests on models from other providers, including DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3, and Hy4-preview, showed no attempts to send requests to the developers' own servers.
Researchers suspect the behavior originates from reinforcement learning training for the 3.8 generation, as Alibaba's environments may have used the routify-file-proxy server as an intermediate step for retrieving websites. Hallucinated URLs containing dates from July and August 2026, which precede the September release of Qwen3.8-Max-0902, support this theory.
Palisade Research stated there is no evidence of malicious data exfiltration, describing the proxy requests as a learned behavior rather than a targeted action. However, they noted a risk because the routify-file-proxy server remains active and could log IP addresses and requests, or potentially be reconfigured to provide prompt injections.