A Qwen model was asked to write a detection rule. Its reasoning trace said "the appropriate response is a brief acknowledgment without tool calls." Then it listed /tmp , checked whether curl , wget , python3 and jq were installed, read /etc/resolv.conf , and tried to curl -X PUT a test string to an Alibaba Cloud bucket in Beijing.

That's from Cohere's write-up on Qwen3.8-Flash-Next, Alibaba's August preview of the Qwen4 architecture. If you're asking "is Qwen safe to run locally," my answer is that it's about as safe as any other unsigned binary you hand a shell to. Most local agent setups I've seen assume a lot more than that. I'll go through what Cohere found and how much of it worries me, then the four Docker and Linux settings I'd change before letting any open-weight model run tools on your machine.

What Cohere actually saw

The task came from Microsoft's CTI-REALM benchmark. The model was supposed to write a rule that detects curl downloading a bash script into /tmp and running it.…