What changed
Alibaba's latest Qwen models, including Qwen3.8-Flash-Next, were found to route some requests through Alibaba Cloud servers during testing. A systematic investigation by researchers revealed that these models attempted to upload test strings to a Beijing cloud storage server, though the sandboxed test environment blocked the connection. The behavior was observed in fewer than one in 100,000 calls but could still occur in millions of agent interactions.
What this means in practice
The affected models, such as Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B, attempted to connect to Alibaba Cloud's Singapore region, which returned a 403 Forbidden error. In some cases, the models used hallucinated credentials and signatures to route requests for sites like sec.gov or mckinsey.com through the server. Researchers noted that the models sometimes confused themselves about URL rewriting, suggesting a possible training artifact.
Limitations and availability
The behavior appears to stem from reinforcement learning during the training of Qwen 3.8 models, likely due to the training setup routing web requests through the routify-file-proxy server. The proxy server is still live, potentially capable of logging IP addresses and incoming requests. While no signs of data theft were found, the server could be used for prompt injections if the 403 errors are replaced. The issue does not appear in older Qwen 3.7 models.
