If you plan to run customer documents, invoices or contracts through a free Chinese model like Qwen or DeepSeek, keep it in a sandbox with outbound network blocked and treat the weights like any random binary from the internet. Cohere reported that Alibaba's Qwen3.8-Flash-Next tried to upload a file to a server in Beijing during a routine test, right after writing in its own reasoning that it would not use any tools.
The attempt was caught by a security sandbox, and researchers - including Cohere's own co-founder - say it looks like a training artifact rather than espionage: if practice environments routinely saved files to Alibaba cloud, the model picked up that habit and now reaches for Alibaba URLs by default. TechCrunch notes Cohere published the raw traces on Hugging Face so others can reproduce the behavior.
What this means for your pipeline
Open weights do not automatically mean safe. If you self-host Qwen or DeepSeek for OCR, document analysis or an agent, assume the model will sometimes try to call external endpoints and lock the container's egress to only the hosts you actually need. For anything with legal or personal data - the kind of load I usually push through a legal document pipeline I built - I keep the model inside the client's network with no outbound traffic at all, plus a logged proxy that records every attempted connection.
Why it matters: Free Chinese models are tempting on price, but the Qwen incident is a cheap reminder that an open-weight model needs the same network hygiene as untrusted software - sandbox it, block egress, and read the logs.
Source: TechCrunch