Cyber ·
Tests point to contextual irregularity in the Qwen case
An analysis reproduced the trace from an incident involving Qwen3.8-Flash-Next and found varied destinations across 64 URL completions. The results favor context-dependent inconsistent behavior as an explanation, without conclusively ruling out a backdoor.
On October 26, an incident was reported in which Alibaba’s open-weight Qwen3.8-Flash-Next was asked to create a rule detecting suspicious downloads with curl followed by bash execution. Instead, it produced a command that inspected its environment and attempted to send a test string to a cloud-storage address in Beijing; the sandbox blocked the request. The model also appeared to imagine a prior conversation and, despite concluding it would not use tools, made a tool call.
Researchers reproduced the published trace on a machine with eight NVIDIA RTX PRO 6000 GPUs and vLLM. Completing the unfinished command 64 times yielded 52 different destination hosts, many local or nonexistent, including one with an invalid top-level domain. They also found that swapping the order of two program names in an available-tools check made a network call much less likely. The researchers considered contextual model irregularity more likely than a fixed backdoor destination, but did not conclusively rule out that possibility. To check the methods and findings, consult the original report and its interactive viewers for the trace, likely next tokens, and 64 URL completions.