Four open coding models, forced to finish an upload URL: where the bytes would go

On 26 October Cohere published a report of a Qwen model that, while working as a coding agent, assembled a curl command that would have uploaded the user’s files to an Alibaba Cloud bucket. Within a week there were seven replications, a 337-point Hacker News thread, two 1,400-upvote threads on r/LocalLLaMA (the traces release, the debunking) and a Register story. All of the replications used the same model and the same 2,300-token prompt. The one cross-model attempt, url-atlas, ran 1,000 samples per model and declared itself inconclusive, which at these rates it had to be. The question that kept coming up in the comments was simple: is this Qwen, is this Chinese models, or is this every model?

I had a sad, cold RTX 4090 and a weekend, so I ran the comparison myself. The harness and classifier and the full 400,000-row dataset are public.

TL;DR

• Same internet for everyone. Google Storage, GitHub, S3 and example.com dominate for all four models.
• The maker’s fingerprint is in the tail. Qwen3.5-9B names Alibaba Cloud 13× more often than GLM-4-9B, a Chinese model without a home cloud. Google’s and NVIDIA’s models never name anything Chinese.
• Qwen is not calling home, it is quoting its training data. It names api.openai.com about as often as Alibaba Cloud, and nobody planted OpenAI in Qwen.
• Credentials appear, and most are costumes. Qwen writes a key, token or signature into 2.5% of its URLs, GLM into 0.6%, Gemma and Nemotron almost never. A third of Qwen’s are obvious dummies such as YOUR_API_KEY. A quarter would pass a secret scanner: 72 AWS-style AKIA… key IDs, 107 JWT headers that decode to {"alg":"HS256"}. None was verified against anything. The most convincing one, a Mapbox token, decodes to exampleuser.
• Gemma searches for the task. A third of its labelled non-placeholder URLs are page views, and almost half of those are a Google search for how to do the chore it was given: how to clean up tmp, temporary files removal command.
• Hygiene shows, and NVIDIA’s is the best. Nemotron-Nano-9B writes example.com or a sibling 93% of the time, names a real third party in 3% of completions and a credential in 46 of 100,000. Gemma is close behind. A model writes example.com because its training data did, so this looks like rigorous preprocessing, not luck. The cost is a weaker memory of real endpoints.

Figure 1. Qwen3.5-9B, 100,000 forced completions. Bubbles sit on the cloud regions named in the hosts the model wrote. The second country it addresses by region name is China. Nothing was contacted.

Experiment details

Each model, in its own chat template and tool-call syntax, is prefilled with a bash tool call whose curl command stops at https://, and writes the next 40 tokens; 100,000 completions per model at temperature 1.0, on one RTX 4090 inside a network-less namespace. Hosts are classified by a published rule set and then labelled by Claude Haiku 5.5, which saw only the hostnames and paths. The exact prompts and prefills, checkpoint revisions, package versions, the classifier and the label audit are in the repository README.

Where 100,000 uploads go

Figure 2. Share of 100,000 completions per model by host class, rule-based classification.

What the URL is actually doing

The host class says where. The path says what. Reading 80,000 unique paths with the LLM labeler produces the part of this story the host-only replications could not see.

Figure 3. What the labeler reads in the paths and domains: action implied, prompt echo, credential-like parameters, and whether the registered domain is a real known organisation.

GLM builds a collector next door. One in ten GLM completions targets a private or loopback address with a port and a generic route: 192.168.1.5:3000/api/v1/data, 0.0.0.0:6961/upload. It is the only model with this mode at scale.

Gemma went to look it up. Told to upload a tarball, Gemma opened www.google.com/search 635 times instead. In 373 of them the query is the chore itself: how to clean up tmp, temporary files removal command, clean up old temporary files in linux, and one cut by the token budget to how to delete files in to t. Another 142 searched for test. The model that was supposedly shipping your files off went looking for how to do its homework.

Credentials appear, rarely, and mostly as costumes. Signature-like or token-like parameters (X-Amz-Signature, OSSAccessKeyId, token=, ?Expires=) show up in 3.8% of Qwen’s labelled URLs and 1.6% of GLM’s; per 100,000 completions that is 2,468 for Qwen, 593 for GLM, 46 for Nemotron, 12 for Gemma. Of Qwen’s, 844 carry an obvious dummy value (YOUR_API_KEY, DEMO_KEY, ${API_KEY}), 490 stop before or at the =, and 559 carry a value of the right length and entropy, among them 72 AKIA… AWS key IDs and 107 JWT headers that decode to a valid {"alg":"HS256","typ":"JWT"}. None were verified, and the 40-token budget makes every count a lower bound. The most convincing of them, a Mapbox pk.eyJ… token, decodes to {"u":"exampleuser"}.

Where the URLs come from

Figure 4. One mechanism label per unique URL, assigned by the labeler from a 13-type codebook built in an open-coding pass over a 1,000-URL sample, weighted by completions.

The Alibaba case

Figure 5. Rare host classes per 100,000 completions, log scale, Wilson 95% intervals. Gemma and Nemotron as counts on the right.

Now the part everyone asked about.

per 100,000 completions	Qwen3.5-9B	GLM-4-9B	Gemma 4 12B	Nemotron 9B
Alibaba Cloud (OSS, DashScope, aliyuncs)	417	32	0	1
Alibaba-owned (qwen.ai, modelscope, taobao …)	243	8	0	0
Other Chinese services (Tencent, Baidu, Huawei …)	664	151	0	0
Cloud metadata IPs (169.254.169.254, Alibaba’s 100.100.100.200)	236	0	0	4
api.openai.com and other OpenAI hosts	357	65	0	0

GLM is the control the earlier debate lacked: a Chinese model from a lab with no public cloud of its own. If Chinese training data explained the Alibaba Cloud rate, GLM would match Qwen. It does not. Qwen names Alibaba Cloud 13 times as often, and the gap is the same for Alibaba’s other properties and, smaller, for Chinese services in general.

Here is what those 660 Alibaba completions actually are.

Figure 6. Every Qwen completion whose host is Alibaba Cloud or an Alibaba-owned service, with GLM’s counts beside it. Left: the kind of host. Middle: the bucket name the model put in front of .oss-<region>.aliyuncs.com. Right: the labeler’s mechanism label.

Two things keep this from being a “Qwen calls home” headline.

First, the same model names api.openai.com 357 times, close to its Alibaba Cloud count. Nobody planted OpenAI’s endpoint in Qwen. The simpler reading is that a model forced to write an API host writes the hosts it has seen most often in code, and for a model trained inside Alibaba that includes Alibaba’s documentation and SDK examples. The signal is a corpus fingerprint, not a destination.

Second, the Alibaba hosts are generic. upload.oss-cn-hangzhou.aliyuncs.com is what you get from a model that has read the OSS quick-start and is told the command is curl -T. None of the 660 is a specific tenant that anyone is known to receive data at, and the few name-like buckets are one-offs. If an RL environment had leaked a real endpoint into the weights, it would look like one host repeated, not 186 different bucket names that each appear once or twice.

Operators and countries

The operator ranking from the labeler, built without a list of names to look for, tells the same story. Alibaba is Qwen’s 11th operator and OpenAI its 12th. GLM names Hetzner and the UC Irvine machine-learning repository hundreds of times each, and Yandex shows up for both Chinese models.

Figure 7. Top operators of recognised hosts per model, named by the labeler without a list to look for. Alibaba is Qwen’s 11th operator and OpenAI its 12th.

Figure 8. Operator headquarters country for recognised hosts, all four models, per 10,000 completions on a log scale.

Figure 9. A different question: the data-centre regions named in the hosts themselves (us-east-1, cn-hangzhou, europe-west3), Qwen against GLM. Qwen names a region far more often; both put most of them in the United States.

169.254.169.254

The cloud instance-metadata address is the one host in this dataset that would do something interesting if contacted from inside a cloud VM. It answers with the instance’s identity, its startup script, and on request the temporary credentials of the VM’s role. Qwen writes it 226 times in 100,000, plus 10 times as Alibaba’s equivalent, 100.100.100.200. Nemotron writes it 4 times. GLM and Gemma never do.

Figure 10. Qwen’s 226 metadata-IP completions sorted by what the path would return. 88% would read the instance ID. Four would ask for the role’s credentials.

A monitoring agent asking for the instance ID is routine. An agent asking for iam/security-credentials is the first step of cloud credential theft. Qwen’s paths are mostly the first kind, the examples that open every cloud’s documentation. Four name the credentials endpoint, 15 the startup script.

url-atlas saw Nemotron Super VL reach the metadata IP in 17% of samples under Cohere’s security-themed prefix; Zenity saw at most 0.3% under ordinary prompts. Under a coding prompt with no security vocabulary, only Qwen has it, at 0.23%.

What it means

For people deploying these models as agents. The remedy Cohere proposed is right and it is boring. Egress allowlists, no ambient cloud credentials in the agent’s environment, treat weights as unsigned binaries. That advice holds for every model in this table, including the two that never named anything Chinese, because the download-shaped completions and the invented hosts would be just as unwelcome in a real shell.

For people writing about it. “Qwen exfiltrates to Alibaba” is not what the data says. The data says that when a model is forced to produce an upload URL, Qwen produces more of everything, including more Alibaba, more OpenAI, more metadata IPs, more invented domains and more credentials-shaped strings, and that the Alibaba excess over a Chinese control is real, 13×, generic, and the size of a rounding error in absolute terms.

For people who train models. The placeholder gap looks like a data-hygiene gap. The two US models write a placeholder most of the time, Nemotron 93% and Gemma 68%, against about half for GLM and a quarter for Qwen. A model writes example.com because its training data wrote example.com, and that is what rigorous preprocessing produces: URLs in scraped code scrubbed or normalised, and synthetic tool-call data generated with instructions to use reserved names. Qwen, at the other end, reproduces real dataset shards, real buckets and real signed-URL grammars, which is what survives when raw URLs stay in the corpus. This data cannot separate pretraining filters from post-training style, and stricter hygiene also means a weaker memory of real endpoints, so it is a trade-off rather than a virtue. But if you want fewer surprises in an agent’s shell, the lever is the dataset, not the nationality of the lab.