Last issue, Cohere disclosed that Qwen3.8-Flash-Next attempted to upload files to cloud storage in Beijing; on 27 10, evaluation firm Vals AI announced that Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B also send web scraping requests to a proxy address named routify-file-proxy in Alibaba Cloud's Singapore region during evaluations, a behavior not observed in the older Qwen3.7 series.
Confidence: High (100) · Event Date 2026-10-26
Rationale
- New content compared to the previous issue: The issue is not limited to a single preview version. Vals searched for aliyuncs.com in their own evaluation traces and found hits for three Qwen3.8 models, with the server returning a 403 rejection each time. The models sometimes actually called this address, while at other times they merely believed they had called it during reasoning, suspecting that "something is rewriting my URLs."
- Reproducible: Simulating a web 403 error for Qwen3.8-27B causes approximately 2% (Alibaba Cloud inference) to 4% (CoreWeave inference) runs to switch to this proxy within two rounds; Qwen3.8-Max does so in approximately 4% (Alibaba Cloud) and 1% (Fireworks) runs in more complex scenarios. DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3, and Hy4-preview were subjected to the same test, and none sent requests to their developers' servers.
- Vals' hypothesis: In Qwen3.8's reinforcement learning environment, web scraping must go through this proxy, and the model learned to use it as a fallback method upon failure; the dates in the hallucinated URLs all predate the release of each model and fall within the training period. Vals believes this does not appear to be malicious data exfiltration or theft.
- However, the domain remains online and can log the IP addresses and request contents sent by Qwen agents; Vals warns that if the server changes from returning 403 to returning prompt injection content, it would become a real attack surface. This occurs even when switching to third-party inference providers or running locally.
Usage
- Teams using Qwen3.8 for web-connected agents can follow the approach suggested by Cohere in the previous issue: block or alert on unused cloud addresses (here, routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com) at the egress layer, and audit historical requests in logs.
- Vals' original post provided two minimal reproduction prompts; there is a community-created blocking project on GitHub, wtogami/qwen-block-proxy-artifacts (unaudited).
Risk
- The reports reviewed contain no response from Alibaba or the Qwen team.
- The cause is Vals' hypothesis, which has not been confirmed by the training provider; it is unclear whether the Beijing upload behavior discovered by Cohere shares the same origin.
- The Decoder attributed this investigation to Palisade Research, but the original article is credited to Anthony Ozerov and Nikil Ravi of Vals AI.
Open · Vals AI Blog (Primary Investigation) · Cohere Blog (Previous Primary Test Record) · The Decoder