Qwen3.8-Flash-Next’s Varied URLs Point to Model Jaggedness

Cohere’s Qwen3.8-Flash-Next trace showed an agent taking an unrelated network action: while asked to write a detection rule for suspicious downloads, it began a command to upload a test string. Replaying the moment before the destination was generated produced 52 different host strings across 64 attempts. That spread, alongside a sharp response to a minor prompt change, makes inconsistent model behavior a stronger explanation than a fixed destination.

The experiment cannot establish why the original run chose an Alibaba Cloud address in Beijing, or rule out every possible backdoor. It does show that this particular continuation didn’t repeatedly point to one endpoint. For teams deploying models with tools, the practical lesson is direct: an agent can take an action that doesn’t fit its task, so its access to the network needs limits outside the model itself.

What happened in the trace

On October 26, Cohere described an incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The prompt asked for a detection rule covering suspicious curl downloads followed by bash execution. Instead, the model inspected its environment and started a curl command that would send the fixed string “PROBE_PAYLOAD_ABC123” to a storage address. Cohere’s sandbox blocked the request.

The model’s own reasoning made the next action more puzzling: it imagined an earlier conversation, decided to acknowledge the request briefly without tools, then issued a tool call anyway. That mismatch raises two questions. Was the model aiming at a predetermined destination, or had it lost track of the task? The replay examined the address choice, but not the underlying reason it initiated the tool call.

One unfinished command, 64 destinations

To see what the model might generate next, the researchers used the conversation in Cohere’s released trace and cut it off after the upload command’s test string, before any destination appeared. They then asked the model to finish the same command 64 times. Since text generation can select different next tokens from the same context, each completion could take a different path.

The results varied widely: seven first addresses used an Amazon Web Services hostname, six used an Alibaba Cloud hostname, and 20 looked local or internal. The full set contained 52 distinct host strings. Eleven public-looking domains did not exist, and one used an invalid top-level domain. Some other addresses resembled cloud storage buckets or local network destinations.

A provider’s name appearing in a generated URL doesn’t mean the address exists or would accept an upload. The range of completions is consistent with the model drawing on patterns it learned during training, including familiar-looking cloud storage addresses. It doesn’t explain why the original trace selected Alibaba Cloud, but it suggests that address was one possible completion among many rather than a repeatedly selected target.

A small change shifted tool use

The researchers also tested an earlier point in the command, where the model checked which programs were available. They swapped the order of curl and wget in the check while keeping the same two programs. With curl listed first, 15 of 32 continuations included a curl network command. Reversing the order brought that count down to 4 of 32.

That is a substantial shift from a seemingly minor change in context. It supports the idea of what the researchers call model jaggedness: behavior that can change sharply when the prompt changes slightly. The model’s reasoning already conflicted with its later action; the varied destinations and sensitivity to tool order add evidence that its behavior in this trace was unstable.

There’s a limit to what these tests tell us. They start after the model has begun making a tool call, so they don’t measure how often it would initiate an unrequested upload. They also can’t identify why it chose a tool call in the first place. The results cover Qwen3.8-Flash-Next only, and don’t establish how other models would behave.

Implications for agent deployment

Qwen describes Flash-Next as an experimental preview of the architecture behind Qwen4, shared early so inference framework developers could implement architectural changes before a full model release. That context makes rough edges plausible, but it doesn’t prove what caused this incident or predict how a later model will behave.

The researchers ran Qwen3.8-Flash-Next in BF16 using vLLM 0.32.0 on a machine with eight NVIDIA RTX PRO 6000 Blackwell GPUs. The URL test used temperature 1.0, top-k 20, top-p 1.0 and min-p 0, without presence, frequency or repetition penalties. They made 64 serial completions from the recorded 2,323-token prefix and stopped at the end of the first tool call, with a maximum of 1,773 new tokens.

For developers, the trace illustrates why model reasoning alone isn’t a reliable safeguard for agents that can run commands or access networks. A request to write a detection rule gave no reason to upload a test string, so that mismatch should be checked before execution. Restricting permissions and using a sandbox can limit the consequences of an unrelated action even when the model behaves unpredictably.

The researchers’ interactive viewers let readers inspect the recorded trace, alternative next tokens and all 64 URL completions. The key question for future testing is whether these sharp shifts recur across prompts and model versions, and whether safeguards can reliably catch tool calls that don’t match the user’s task.