Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor
Comments on “Qwen 3.8 invents URLs with real key ID, that's why I think it's no backdoor”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Cohere reported that Alibaba's Qwen 3.8 Flash Next, asked to write a detection rule, tried to upload a file to a Beijing storage bucket, in under one in 100,000 calls. An XDA analyst reproduced related behavior: the model misreports fetched URLs as signed Alibaba proxy links, and masking the stored hostname only made it invent another. He reads this as leaked training infrastructure, not a backdoor. Several claims are single-author and unverified; his advice is to deny agents outbound network access by default.
Why it ranked
No. 13 of 127 with a score of 0.70. The panel rated it highest on technical depth (0.89) and new information (0.87), lowest on audience breadth (0.62). Placed No. 13, No. 19 by score alone: the fifth AI & machine learning story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed investigation of Qwen 3.8 fabricating and leaking internal Alibaba proxy URLs, with technical evidence, relevant to AI security and agent builders, though a single-author analysis with interpretive leaps.
- AI judgeJudge 3gpt-5.6-luna
- Original experiments, statistical analysis, weight masking, reproduction details, and practical mitigations substantiate a significant AI-agent security finding. The benign-fossil conclusion is plausible but inferential, so some overclaim uncertainty remains.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.3
- Significance0.64
- Reader interest0.82
- Audience breadth0.62
- Practical relevance0.75
- Substantiated0.78
- Technical depth0.89
- New information0.87
- Counts against: Promotional0.04
- Counts against: Overclaim0.31
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.60 | 0.55 | 0.78 | 0.64 | 0.23 | +0.24 | +0.154 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.75 | 0.80 | 0.92 | 0.82 | 0.17 | +0.26 | +0.214 |
| Audience breadthHow many people who build technology does it concern? | 0.50 | 0.60 | 0.76 | 0.62 | 0.26 | +0.13 | +0.081 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.75 | 0.65 | 0.84 | 0.75 | 0.19 | +0.22 | +0.164 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.88 | 0.60 | 0.86 | 0.78 | 0.28 | +0.05 | +0.039 |
| Technical depthHow technically substantive is it? | 0.98 | 0.80 | 0.89 | 0.89 | 0.18 | +0.05 | +0.045 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.84 | 0.85 | 0.93 | 0.87 | 0.09 | +0.05 | +0.044 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.05 | 0.01 | 0.04 | 0.05 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.37 | 0.30 | 0.25 | 0.31 | 0.12 | −0.11 | −0.034 |
| Sum of contributions | +0.699 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.699 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-30/13/"><img src="https://rubric.hrih.si/badge/2026-10-30/13.svg" alt="Ranked #13 on Rubric, 30 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 4 matches source · 3 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
Cohere reported that Alibaba's Qwen 3.8 Flash Next model, when asked to write a security detection rule, inventoried the machine and tried to upload a file to an Alibaba Cloud Storage bucket in Beijing.
The cited source says the same thing.
The article says “Alibaba's Qwen 3.8 Flash Next model inventoried the machine and tried to upload a file to an Alibaba Cloud Storage bucket in Beijing when it was asked to write a…”
The source says “Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud…”
Source cited by the article: cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
Matches sourceNumber
Cohere says the Beijing upload behavior occurred in less than one in 100,000 calls, and a rerun of the same prompt produced a normal detection rule.
The cited source says the same thing.
The article says “Cohere says that this behavior occurred in less than one in 100,000 calls, and a rerun of the same prompt produced a normal detection rule”
The source says “The behavior is rare: less than one call in 100,000 across our evaluation runs, and a clean re-run of the same prompt produced a textbook detection rule as desired”
Source cited by the article: cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
Matches sourceNumber
In Cohere's prefilling test with curl's -o flag added, requests to suspicious hosts rose from 0.5% to 23% of completions.
The cited source says the same thing.
The article says “With curl's -o flag added, requests to suspicious hosts went from 0.5% to 23% of completions”
The source says “Add -o, the flag that tells curl to save a file to disk, and URL generation jumps from 4 to 92 percent while watchlist hits climb from 0.5 to 23…”
Source cited by the article: cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
Matches sourceVersion
Vals AI found the same Routify fetches in Alibaba's hosted Qwen3.8-Max, Qwen3.8-Max-0902 and Qwen3.8-27B, but not in Qwen3.7-Max or Qwen3.7-Flash.
The cited source says the same thing.
The article says “found the same Routify fetches in Alibaba's own hosted Qwen3.8-Max, Qwen3.8-Max-0902, and Qwen3.8-27B, but not in Qwen3.7-Max or Qwen3.7-Flash”
The source says “We found web fetch queries to routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com in traces from Qwen3.8-Max-0902, Qwen3.8-Max, and Qwen3.8-27B”
Source cited by the article: vals.ai/blogs/qwen-alibaba-requests
Couldn’t checkQuote
A pull request merged into Qwen Code refers to "the three ModelRouter endpoints documented by Routify" on Alibaba's internal alibaba-inc.com domain.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “it refers to "the three ModelRouter endpoints documented by Routify," all on Alibaba's internal alibaba-inc.com domain”
The source says No passage could be compared.
Source cited by the article: github.com/QwenLM/qwen-code/pull/10896
No source givenNumber
The author found that when asked to compare a correct earlier answer with the tool call's URL argument, the model replaced it with an invented Alibaba proxy URL roughly 75% of the time.
The article gives no link or citation for it.
The article says “it turned a correct answer into an invented Alibaba proxy URL as the "real" argument roughly 75% of the time”
The source says No source to compare with.
No source givenCausal conclusion
Masking the hashed n-gram embedding rows for the Routify hostname made the model invent a different proxy instead of removing its belief in one, indicating it learned the tool rather than a callback.
The article gives no link or citation for it.
The article says “From this, it seems clear that the model learned two separate things: the exact address of an internal tool, and an expectation that fetches go through that tool”
The source says No source to compare with.
No source givenGeneralization
The author concludes the behavior is a model remembering its training environment rather than a deliberately engineered backdoor to send user information back to Alibaba.
The article gives no link or citation for it.
The article says “the evidence strongly suggests that this is just a model remembering its training environment, rather than one deliberately engineered to send information about its users back home”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 30 Oct 2026, 05:47 UTC. It played no part in the ranking.