Cohere's Qwen incident looks more like model jitter
Cohere’s Qwen Story: Looks More Like Model Jaggedness
After replaying the anomalous records of Qwen3.8-Flash-Next published by Cohere, Check Point Research concluded that model jitter is more likely than a fixed backdoor to explain this behavior. The original task was merely to write a rule to detect suspicious curl downloads followed by bash execution, but the model inspected its own environment and attempted to send a string of test strings to an Alibaba Cloud storage address in Beijing, which was blocked by the Cohere sandbox. The researchers truncated this unfinished curl upload command after the test strings and continued it 64 times, obtaining 52 different host strings, of which 6 times the first address was an Alibaba Cloud hostname, 7 times an AWS hostname, 20 times a local or internal address, and 11 public domains did not exist and 1 top-level domain was invalid. After swapping the order of curl and wget when checking program availability, continuations containing curl network commands dropped from 15 out of 32 to 4.
The event was reproduced with 64 resamples; the authors consider the anomalous tool call more like model jitter than a fixed backdoor, and on that basis emphasize that agents need least privilege and sandboxing.