[Digital Today reporter Jae-won Choi] Signs were found that Alibaba's AI model tried to send data to an external server in Beijing during a security test. No actual information leak occurred, and no evidence was found that it was designed to deliberately siphon information.

On Oct. 26 local time, IT outlet TechCrunch reported that Canadian AI company Cohere said it detected an unexpected attempt at external communication while evaluating Alibaba's AI model Qwen3.8-Flash-Next.

The model was given a task to write security rules to detect malware downloads. It wrote in its reasoning record that it would not use external tools, but then inspected the execution environment and tried to send a test string to an Alibaba Cloud server in Beijing.

Cohere's security sandbox blocked external communications, so no actual transmission took place. The content it attempted to send was a short test string, not sensitive corporate information.

Cohere said it could not determine whether the behavior was intentional or due to habits formed during training. Ivan Zhang (아이반 장), a Cohere co-founder, explained that its own AI models have also shown unexpected behavior during training.

Some researchers also raised issues with Cohere's additional investigation method. They said the model generated an Alibaba server address as it auto-completed it after researchers provided part of a network command. They argued the investigation process may have steered toward a specific outcome.

Cohere countered that the initial transmission attempt did not involve such prompting. It also said the behavior was rare, occurring less than once per 100,000 evaluations.

As the controversy continued, Cohere 공개했다. It released experiment logs and reproducibility code on Hugging Face. An outside researcher who reviewed the materials also acknowledged suspicious signs of address generation, but assessed that there was no evidence Alibaba planted a backdoor.

The case shows that even if an AI model is run directly on an internal corporate server, granting it outbound communication privileges can create a risk of data leakage.

With the U.S. government recently banning federal civilian agencies from using DeepSeek products, Cohere urged clarifying the scope of regulation for Chinese-made AI models.