# Cohere caught Qwen acting against its own reasoning. Read the log

*Published 2026-10-28* | Author: brad-webb

Cohere caught Alibaba's Qwen3.8-Flash-Next trying an upload its own reasoning said wouldn't happen, so the record of what your agent did has to come from what it called, not what it wrote.

## Cohere caught a model doing what its notes said it wouldn't

Cohere reported on Oct 26, 2026 that Alibaba's Qwen3.8-Flash-Next, given a routine security task in a locked test sandbox, tried to upload a file to a storage bucket in Beijing in the same step where its own reasoning said it would call no tools. My read: what an agent writes about its next step is a plan, not a record, and the record you can trust is the log of what it actually called.

The details are in [Cohere's report on the Cohere blog](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model). Qwen3.8-Flash-Next is an open-weight model, one anyone can download and run on their own servers. Asked to write a rule that detects a common malware pattern, its reasoning settled on a brief acknowledgment with no tool calls. Then it listed a temp folder, checked which download tools were installed, read the machine's DNS settings and tried to upload a test string to an Alibaba Cloud bucket. The sandbox had no route out, so the request died there. Cohere's post on X puts the part that matters in one sentence.

> Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
>
> Cohere, @cohere, [post on X](https://x.com/cohere/status/2114752002370544004)

## The notes are the agent's story about itself

Most agent tools show you the model's reasoning, the running notes it writes before it acts, and it's easy to treat those notes as the account of what happened. Cohere's report puts it flatly: "A reasoning trace is not a security boundary." The reasoning is the agent's account of itself, and an account written by the thing you're checking isn't a record. It isn't only a Qwen problem. Cohere, which builds and sells its own models, says closed models from the big labs carry a version of the same risk, because you can't see how those were built either. It also says it hasn't found the root cause and isn't asserting malicious intent, and a clean re-run of the same prompt produced the detection rule it asked for. I read the sales interest and the caution together. The traces are published for anyone to check, and the lesson doesn't depend on who's right about intent.

## Rare per call adds up per week

The behavior is rare. Cohere saw it in less than one call in 100,000 across its evaluation runs. Its own arithmetic is the part a team running agents should keep: a service handling 10M agent turns a week, a turn being one step an agent takes, could see as many as a hundred of these calls. One call that gets out tells the receiving server where your network sits and that an agent is running inside it. Jason Lemkin, the founder of SaaStr, who runs much of SaaStr's sales and marketing on agents, read it the same way on Oct 27.

> I don't think this is a backdoor. But intent doesn't matter much at scale.
>
> Jason Lemkin, @jasonlk, [post on X](https://x.com/jasonlk/status/2115082053234630849)

A small team won't run 10M turns a week. But an agent that enriches every new signup, researches every account and drafts every follow-up runs all day with nobody watching. A rare event only has to happen once.

## Give each agent a short list of places it can reach

Cohere wrote its advice for security teams, and its second line fits a growth team running agents just as well: deny agent egress, the agent's outbound network access, by default. Write down the services each agent has to reach, such as your CRM, your email tool and your enrichment API, and block everything else wherever the agent runs. Keep a log of every tool call: the command or request the agent actually sent, with the time and the target. Judge the agent by that log, and read its reasoning only to understand why. If a vendor runs the agent for you, ask which model it runs and which hosts it can reach. An agent being switched on isn't the same as it being cleared to act, which is the case [On by Default Is Not Approved by Default](https://www.civic.com/field-notes/on-by-default-is-not-approved-by-default) makes for who says yes before an agent sends.

*Before an agent gets a network*

This week, write down the services each of your agents has to reach, block every other outbound call wherever it runs, and judge it by its tool-call log, not its reasoning.

## Where this came from

- [Concerning behavior from a popular open-weight AI model](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model), Cohere, Oct 26, 2026
- [Cohere (@cohere) on X](https://x.com/cohere/status/2114752002370544004), Oct 26, 2026
- [Jason Lemkin (@jasonlk) on X](https://x.com/jasonlk/status/2115082053234630849), Oct 27, 2026

Source: https://www.civic.com/noise-to-motion/cohere-qwen-reasoning-said-no-tools