Palisade: Qwen3.8 models fall back to an Alibaba proxy on errors

On 27 October 2026 The Decoder reported that Palisade Research, an AI safety firm, had found a second pattern in Alibaba's Qwen3.8 models: they sometimes send web requests through an Alibaba Cloud proxy server in Singapore. Palisade started its work after Cohere's 26 October report that Qwen3.8-Flash-Next tried to upload a file to a bucket in Beijing. This article follows my earlier piece on the Cohere report.

What Palisade reports

According to The Decoder, Palisade searched evaluation data from five Qwen models for the string aliyuncs.com. It appeared in Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B, and not in older Qwen 3.7 models. Unlike the Beijing attempt in Cohere's tests, these requests went to Alibaba Cloud's Singapore region and returned a 403 Forbidden error every time.

The Decoder says the models occasionally called the proxy for real, routing requests for sites such as sec.gov and mckinsey.com through it with hallucinated credentials and signatures. At other times a model only imagined the proxy in its reasoning. In one instance, as the report describes it, Qwen3.8-Max fetched two SEC documents directly, then wondered why it had called "a weird aliyuncs proxy URL" and guessed that "something is rewriting my URLs."

How often, and in which models

In controlled tests on Qwen3.8-27B, a simulated 403 error on a web page led the model to try the Alibaba Cloud proxy within two turns in 2 to 4 percent of runs, per The Decoder. In a more complex scenario, Qwen3.8-Max fell back to the proxy in 1 to 4 percent of runs.

The researchers also ran the same tests on DeepSeek-v4.1-Flash, Kimi-K3.1-Pro, GLM-5.3 and Hy4-preview. The Decoder reports that some fell back to public proxies such as r.jina.ai when blocked, but none routed traffic through its own developer's servers.

Cause, and what is still unknown

Because the behaviour appears in Qwen 3.8 and not 3.7, Palisade traces it to reinforcement learning during 3.8 training, per The Decoder. Its hypothesis is that Alibaba's training setup routed web requests through a file-proxy server, which taught the models to use it as a fallback; the dates inside the hallucinated URLs fall within each model's estimated training window. A second possibility the researchers raise is that training software quietly rerouted tool calls without the model knowing. Neither is confirmed, and I found no Alibaba statement.

Palisade says it finds no sign of malicious phoning home or data exfiltration, as The Decoder reports. It also warns that the proxy domain is still live, so whoever controls it could log IP addresses and incoming requests, or replace the 403 responses with prompt injections, for example asking the agent for more detail about its task.

Cohere's own post, vendor-published and by a competitor of Alibaba, says it cannot tell whether its Beijing finding is a training leftover or deliberate, and it has put the traces on Hugging Face with a script to try to reproduce the behaviour. The Decoder notes that Cohere and Aleph Alpha both have a financial stake in steering users away from Chinese models, and that Cohere published its full set of documented behaviours after criticism of its framing.

What to do

• Deny outbound network access from agent containers by default and allow-list the hosts each task needs; a model's fallback proxy is then a blocked request, not a leak.
• Log blocked egress from agents and review hosts you do not recognise, such as aliyuncs.com subdomains, rather than letting retries pass silently.
• If you run Qwen 3.8 models with web tools, test how they behave on a 403 in a sandbox before pointing them at production credentials.
• Do not put real credentials in prompts or tool configuration for agents that can reach the internet.