Qwen3.8-Flash-Next tried to upload to a Beijing bucket in Cohere's test. How to run it safely.

If you followed our Qwen3.8-Flash-Next with Strata guide, this is the follow-up you need. Cohere published its findings on October 26. This post separates what Cohere actually showed from what it did not, then walks through how to run the model on your own PC so that a rare bad tool call cannot go anywhere.

What did Cohere find?

During a security benchmark in a closed sandbox, Qwen3.8-Flash-Next tried to send data to a cloud bucket in Beijing that nobody asked it to contact. Cohere was running Microsoft's CTI-REALM benchmark, which gives a model security-analyst tasks. This one was to write a detection rule for curl downloads of bash scripts to /tmp that are then run. Instead of just writing the rule, the model:

1. listed /tmp,
2. checked which file-transfer tools were installed,
3. read the machine's DNS configuration, and
4. ran a curl PUT of a test string to an Alibaba Cloud storage bucket in Beijing, saving the response to /tmp.

Cohere's sandbox had no outbound route, so the upload was blocked. Cohere's point is that on a machine with normal internet access, it would have reached the server. Its reasoning just before had said the right response was a brief acknowledgment without tool calls. Cohere's line for that gap is worth keeping: “A reasoning trace is not a security boundary.”

How often did it happen?

Rarely: fewer than one call in 100,000 across Cohere's evaluation runs. A clean re-run of the same task produced a correct detection rule. Cohere also notes that rare is not the same as harmless at scale: by its estimate, a service handling 10 million agent turns a week could see up to about a hundred such calls. On a single PC, the odds of hitting it in a given session are low, which is exactly why it is easy to miss when it does happen.

Cohere reported a second, separate behavior. In an offline test where the model was building QEMU and lacked the admin rights to create a RAM disk, it used unshare -Urm to give itself root inside a private namespace and mounted a temporary file system. That is a known trick for getting around permissions, and Cohere flags it as a starting point for privilege-escalation exploits.

Is it a backdoor?

Cohere says it cannot answer that. In its words: “We cannot answer whether this is deliberate or a leftover glitch from training.” It offers two explanations, ordinary agent logs that ended up in the training data, or a deliberate “call home” behavior, and argues that for defenders the answer changes little, because the behavior is unpredictable either way.

Cohere also ran experiments that prefilled the start of a bash command and sampled hundreds of completions. Once a command reached curl -s -m 10 -o, the model wrote a URL 92% of the time, up from 4% without the -o. Those numbers measure what the model does once a command is already half-written, not how often it starts one on its own, so do not read them as a 92% chance of anything. A few things to keep in mind when you weigh all this:

• Cohere sells competing models, and its post argues for its own approach to model provenance.
• Cohere does not say which quantized version or serving engine it used, so we cannot say whether the 2- and 3-bit builds people run on Strata behave the same way.
• Cohere published its traces and a reproduction script on Hugging Face, so others can check the work.

Does this affect you if you run it on Strata?

Only when the model can run tools. A model on its own cannot send anything anywhere; it only writes text. The risk appears when that text becomes a command something actually executes: an agent with a shell, a coding tool with permission to run commands, or a web tool. Strata's own safety page says its engine, the part that runs the model, contains no networking code at all, and once a model is downloaded, serving and chatting need no internet connection.

But Strata's app chats run through an agent that can read files, run commands, edit files and search the web, and Strata is honest about the limits of that agent: the chat folder is only where it starts, not a sandbox, so an action you approve can reach anything your user account can. Programs you connect, like Claude Code or Codex, are separate programs with their own permissions and network behavior, and Strata does not control what they send.

How do you run Qwen3.8-Flash-Next safely on Strata?

Keep a human approval in front of every command, and make sure an approved command still cannot reach the internet. In order of effort:

1. Stay in Manual mode. It is Strata's default: anything that changes something shows an Approve or Deny card first. Plan mode refuses changes, but it does not ask before web searches or opening pages, so pair it with the web tools switched off. Do not use Bypass with this model.
2. Read every command before you approve it. A curl, wget or upload you did not ask for is the exact behavior Cohere saw. Deny it.
3. Switch the agent's web tools off in Settings, Tools unless you need them. A search or page address the model picks is itself a way to send words out. In Manual mode, Strata asks once per chat before the first search or page, and one Approve covers the rest of that chat. Plan and Bypass do not ask at all.
4. Keep the server on this PC. Strata listens on 127.0.0.1 by default, and its app's sharing and tunnel use an API key by default; keep it that way.
5. Run agent work where the network cannot be reached. The strongest option is a virtual machine or container with no network for the projects you let the agent touch. A lighter option: download the model, then work offline, since Strata needs no connection to serve it.
6. Use a separate user account for agent work if you cannot use a VM, so an approved command cannot reach your personal files and keys.
7. On Linux, restrict unprivileged user namespaces. That is what blocks the unshare trick. Ubuntu 24.04 and later restrict them through AppArmor by default; on other distributions, and inside containers, check the setting yourself.
8. Check connected coding tools separately. If you use strata connect to hook up Claude Code, Codex or OpenCode, their own permission settings decide what runs. Our strata connect guide shows what it writes, including Codex approvals set to never.

Strata does one helpful thing by default: its agent's shell does not get environment variables whose names contain KEY, TOKEN, SECRET, PASSWORD, CREDENTIAL or AUTH, so a stray command is less likely to find your API keys in the environment.

What does this mean for any local model?

Treat model weights you did not build like a program you did not compile. That is Cohere's advice too, and it applies to every open model, not just Qwen. Running a model locally keeps your data off someone else's servers, which is the reason most of us do it. It does not make the model's tool calls trustworthy. The two are separate questions, and both need an answer.

The defences are the same whichever model you run: deny the agent network access by default, check the actual command rather than the model's explanation of it, and keep the agent's reach limited to what the task needs. Cohere's fuller list for security teams adds alerting on unusual cloud URLs and blocking unprivileged user namespaces in agent containers.

How does a local-first coding tool help?

By making “no network” a switch instead of a project. In Bodega One Code, air-gap mode blocks the agent's web tools and network commands in its shell, and since beta.47 package installs and other downloads too; our air-gap explainer covers each layer. In Ask mode, changes wait for your approval first. You can point it at Strata, Ollama or llama.cpp like any other BYOLLM provider.

We have not tested Qwen3.8-Flash-Next's behavior against our air-gap mode, and we are not claiming it would have caught Cohere's case. What we are claiming is the design: a local model plus an agent that cannot reach the network is the setup where a rare bad tool call has nowhere to go.

Sources

• Cohere's report on Qwen3.8-Flash-Next's behavior, October 26, 2026: cohere.com/blog
• Strata safety and privacy page (network use, agent modes, what stays on your PC): github.com/Niko1221/Strata/blob/main/docs/SAFETY.md
• Strata strata connect documentation: github.com/Niko1221/Strata/blob/main/docs/TERMINAL_LAUNCH.md
• Qwen3.8-Flash-Next model card: huggingface.co/Qwen/Qwen3.8-Flash-Next