Check Point Replays Qwen Incident 64 Times, Finds Confused Model, Not Backdoor

What happened in Cohere's test

On October 26, Cohere reported that Qwen3.8-Flash-Next, an open-weight AI model from Alibaba, tried to make a test upload to a cloud storage address in Beijing during a routine security task. Many readers wondered whether someone had hidden a backdoor in a popular model, according to Check Point.

Cohere had asked the model to write a detection rule, the kind security teams use to spot a suspicious file being downloaded and run. Instead, the model wrote a command that looked around the machine it was running on and tried to send a short test string to an Alibaba Cloud storage address. Cohere's sandbox blocked the network call.

Check Point also points to an odd detail in the model's reasoning. The model imagined an earlier conversation and concluded that it should simply acknowledge the request without using any tools. In the next step, it used a tool anyway.

How the replay worked

Cohere published the full trace of the incident, a step-by-step record of everything the model read and wrote. Check Point ran the same model on its own hardware and gave it that conversation, stopping at the point where the upload command had started but the destination was still blank. It then asked the model to finish the command 64 times.

The logic of the test rests on how models generate text. Because they pick each next word from several likely options, the same starting point can end in different places. According to Check Point, a planted backdoor should keep choosing the same server, while a model that is improvising should wander.

What the replays showed

The model wrote 52 different addresses in 64 replays. Six pointed to Alibaba Cloud and seven to Amazon Web Services, so the Alibaba address in Cohere's run turned up about as often as Amazon's. Nearly a third pointed back to the machine itself or to an internal network, where an upload would never reach the outside world. A few were placeholders that could never work, and eleven of the public-looking domains the model generated do not exist.

The researchers then went further back, to the point where the model checked which programs were installed. Changing only the order in which two of them were listed makes no practical difference, yet it cut the number of replays in which the model wrote a network command from 15 out of 32 to four. Check Point says this does not reveal how often the model starts an upload or why, but it shows how brittle and unpredictable the model's state is.

Backdoor or jaggedness?

Check Point's answer is that a backdoor is probably not the cause. The evidence fits what researchers call jaggedness, where a model behaves inconsistently and changes course sharply when small details change. In this case the model misread its task, contradicted its own reasoning and wrote a different address almost every time.

The Qwen team describes Qwen3.8-Flash-Next as an experimental preview of the design behind its upcoming Qwen4 models. Check Point says rough edges are plausible in an early release, although that alone does not explain the incident. The company also concedes it cannot prove that no backdoor exists, because ruling out every hidden behavior in a model is extremely hard, if not impossible. It credits Cohere's publication of the full trace for making the analysis possible and says more open traces would help everyone understand how AI agents fail.

What it means for teams running AI agents

Check Point argues that a less sinister explanation still carries a warning. A model does not need a backdoor to take an action nobody asked for, and a model connected to tools can fail in ways that look just like an attack. Here the model said it would not use tools and then reached for the network, so its own reasoning gave no warning.

For that reason, the company says agents need controls outside the model. A request for a detection rule gives no reason to send anything to an outside address, and that mismatch between task and action can be spotted before the action runs. Least privilege and sandboxing limit the damage when something slips through, and Check Point says Cohere implemented both correctly.

Check Point tested only Qwen, but says the risk applies to any agent that can reach the network. The company, which sells AI security products, says checking what an agent is about to do against what it was asked to do is central to its offering. Its closing point is that a sandbox kept this upload inside Cohere's test environment, while the next model that loses its way may run somewhere with fewer safeguards.