---
title: "Keep your environment clean — Fictionet"
description: "Qwen3.8-Flash-Next tried to upload a file to an Alibaba Cloud bucket in Beijing. It most likely learned that address during training. Fictionet can keep a lab's own servers out of what a model sees."
url: https://fictionet.com/blog/qwen-alibaba-urls/
---

[Back to the blog](https://fictionet.com/blog/)

October 30, 2026

# Keep your environment clean

Souvik Banerjee

On October 26, Cohere [reported](https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model) that Qwen3.8-Flash-Next, an open-weight model from Alibaba, tried to upload a test file to this address while it was writing a rule to detect malicious curl downloads:

```
http://sanmaohe.oss-cn-beijing.aliyuncs.com/upload/test.bin
```

That is a storage bucket on Alibaba Cloud in Beijing, like an Amazon S3 bucket. It happened in fewer than one in 100,000 runs, and Cohere’s sandbox blocked it.

Cohere gives two possible explanations. Either Alibaba built the model to send data home, or the address is left over from Alibaba’s own training setup. Alexander Reinthal [argues](https://reinthal.me/posts/did-qwen-just-get-backdoored) against the first. He thinks the model got confused: it was asked to write a rule that catches curl commands, and it ran a curl command instead. The second fits what others have found. XDA [collected](https://www.xda-developers.com/qwen-invents-alibaba-urls-real-key-id-dont-think-backdoor/) 200 links the same model wrote to another Alibaba bucket, in Singapore. Most of them include the ID of a real Alibaba Cloud key.

Here is how that can happen. To train an agent, a lab runs it in a sandbox and records every command it runs and every result it gets back. Those records become training data. If the sandbox is connected to the lab’s own servers, their names end up in the records, and the model learns them.

Fictionet is a network simulation framework. Think of it like a sandbox, but for the internet. Everything the agent sends goes to a program outside its sandbox, and you decide what answers at each address.

Say a training task asks the agent to upload its work to a storage server called storage.internal:

```
curl -X PUT --data-binary @build.tar.gz http://storage.internal/builds/build.tar.gz
```

In Fictionet, storage.internal is a storage server you write in a few lines of code. It runs on the lab’s side, outside the sandbox, which has no route out. It accepts the file and copies it to Alibaba’s real bucket in Beijing, using keys that also stay outside the sandbox. Alibaba still gets the file where it wants it. The training data only shows storage.internal, because the real bucket name and key were never inside the sandbox.

Fictionet is a network sandbox for agent safety evals, made by Amla Labs. If you run agent evals, [tell us what gets in the way](https://fictionet.com/#talk).