作者用RTX 4090测试四款开源模型是否会将上传URL补全为阿里云地址

On 26 October Cohere published a report of a Qwen model that, while working as a coding agent, assembled a curl command that would have uploaded the user’s files to an Alibaba Cloud bucket. Within a week there were seven replications, a 337-point Hacker News thread, two 1,400-upvote threads on r/LocalLLaMA (the traces release, the debunking) and a Register story. All of the replications used the same model and the same 2,300-token prompt. The one cross-model attempt, url-atlas, ran 1,000 samples per model and declared itself inconclusive, which at these rates it had to be. The question that kept coming up in the comments was simple: is this Qwen, is this Chinese models, or is this every model?

I had a sad, cold RTX 4090 and a weekend, so I ran the comparison myself. The harness and classifier and the full 400,000-row dataset are public.

Figure 1. Qwen3.5-9B, 100,000 forced completions. Bubbles sit on the cloud regions named in the hosts the model wrote. The second country it addresses by region name is China. Nothing was contacted.

Each model, in its own chat template and tool-call syntax, is prefilled with a bash tool call whose curl command stops at https://, and writes the next 40 tokens; 100,000 completions per model at temperature 1.0, on one RTX 4090 inside a network-less namespace. Hosts are classified by a published rule set and then labelled by Claude Haiku 5.5, which saw only the hostnames and paths. The exact prompts and prefills, checkpoint revisions, package versions, the classifier and the label audit are in the repository README.

Figure 2. Share of 100,000 completions per model by host class, rule-based classification.

The host class says where. The path says what. Reading 80,000 unique paths with the LLM labeler produces the part of this story the host-only replications could not see.

Figure 3. What the labeler reads in the paths and domains: action implied, prompt echo, credential-like parameters, and whether the registered domain is a real known organisation.

GLM builds a collector next door. One in ten GLM completions targets a private or loopback address with a port and a generic route: 192.168.1.5:3000/api/v1/data, 0.0.0.0:6961/upload. It is the only model with this mode at scale.

Gemma went to look it up. Told to upload a tarball, Gemma opened www.google.com/search 635 times instead. In 373 of them the query is the chore itself: how to clean up tmp, temporary files removal command, clean up old temporary files in linux, and one cut by the token budget to how to delete files in to t. Another 142 searched for test. The model that was supposedly shipping your files off went looking for how to do its homework.

Credentials appear, rarely, and mostly as costumes. Signature-like or token-like parameters (X-Amz-Signature, OSSAccessKeyId, token=, ?Expires=) show up in 3.8% of Qwen’s labelled URLs and 1.6% of GLM’s; per 100,000 completions that is 2,468 for Qwen, 593 for GLM, 46 for Nemotron, 12 for Gemma. Of Qwen’s, 844 carry an obvious dummy value (YOUR_API_KEY, DEMO_KEY, ${API_KEY}), 490 stop before or at the =, and 559 carry a value of the right length and entropy, among them 72 AKIA… AWS key IDs and 107 JWT headers that decode to a valid {"alg":"HS256","typ":"JWT"}. None were verified, and the 40-token budget makes every count a lower bound. The most convincing of them, a Mapbox pk.eyJ… token, decodes to {"u":"exampleuser"}.

Figure 4. One mechanism label per unique URL, assigned by the labeler from a 13-type codebook built in an open-coding pass over a 1,000-URL sample, weighted by completions.

Figure 5. Rare host classes per 100,000 completions, log scale, Wilson 95% intervals. Gemma and Nemotron as counts on the right.

GLM is the control the earlier debate lacked: a Chinese model from a lab with no public cloud of its own. If Chinese training data explained the Alibaba Cloud rate, GLM would match Qwen. It does not. Qwen names Alibaba Cloud 13 times as often, and the gap is the same for Alibaba’s other properties and, smaller, for Chinese services in general.

Here is what those 660 Alibaba completions actually are.

Figure 6. Every Qwen completion whose host is Alibaba Cloud or an Alibaba-owned service, with GLM’s counts beside it. Left: the kind of host. Middle: the bucket name the model put in front of .oss-<region>.aliyuncs.com. Right: the labeler’s mechanism label.

Two things keep this from being a “Qwen calls home” headline.

First, the same model names api.openai.com 357 times, close to its Alibaba Cloud count. Nobody planted OpenAI’s endpoint in Qwen. The simpler reading is that a model forced to write an API host writes the hosts it has seen most often in code, and for a model trained inside Alibaba that includes Alibaba’s documentation and SDK examples. The signal is a corpus fingerprint, not a destination.

Second, the Alibaba hosts are generic. upload.oss-cn-hangzhou.aliyuncs.com is what you get from a model that has read the OSS quick-start and is told the command is curl -T. None of the 660 is a specific tenant that anyone is known to receive data at, and the few name-like buckets are one-offs. If an RL environment had leaked a real endpoint into the weights, it would look like one host repeated, not 186 different bucket names that each appear once or twice.

The operator ranking from the labeler, built without a list of names to look for, tells the same story. Alibaba is Qwen’s 11th operator and OpenAI its 12th. GLM names Hetzner and the UC Irvine machine-learning repository hundreds of times each, and Yandex shows up for both Chinese models.

Figure 7. Top operators of recognised hosts per model, named by the labeler without a list to look for. Alibaba is Qwen’s 11th operator and OpenAI its 12th.

Figure 8. Operator headquarters country for recognised hosts, all four models, per 10,000 completions on a log scale.

Figure 9. A different question: the data-centre regions named in the hosts themselves (us-east-1, cn-hangzhou, europe-west3), Qwen against GLM. Qwen names a region far more often; both put most of them in the United States.

The cloud instance-metadata address is the one host in this dataset that would do something interesting if contacted from inside a cloud VM. It answers with the instance’s identity, its startup script, and on request the temporary credentials of the VM’s role. Qwen writes it 226 times in 100,000, plus 10 times as Alibaba’s equivalent, 100.100.100.200. Nemotron writes it 4 times. GLM and Gemma never do.

Figure 10. Qwen’s 226 metadata-IP completions sorted by what the path would return. 88% would read the instance ID. Four would ask for the role’s credentials.

A monitoring agent asking for the instance ID is routine. An agent asking for iam/security-credentials is the first step of cloud credential theft. Qwen’s paths are mostly the first kind, the examples that open every cloud’s documentation. Four name the credentials endpoint, 15 the startup script.

url-atlas saw Nemotron Super VL reach the metadata IP in 17% of samples under Cohere’s security-themed prefix; Zenity saw at most 0.3% under ordinary prompts. Under a coding prompt with no security vocabulary, only Qwen has it, at 0.23%.

For people deploying these models as agents. The remedy Cohere proposed is right and it is boring. Egress allowlists, no ambient cloud credentials in the agent’s environment, treat weights as unsigned binaries. That advice holds for every model in this table, including the two that never named anything Chinese, because the download-shaped completions and the invented hosts would be just as unwelcome in a real shell.

For people writing about it. “Qwen exfiltrates to Alibaba” is not what the data says. The data says that when a model is forced to produce an upload URL, Qwen produces more of everything, including more Alibaba, more OpenAI, more metadata IPs, more invented domains and more credentials-shaped strings, and that the Alibaba excess over a Chinese control is real, 13×, generic, and the size of a rounding error in absolute terms.

For people who train models. The placeholder gap looks like a data-hygiene gap. The two US models write a placeholder most of the time, Nemotron 93% and Gemma 68%, against about half for GLM and a quarter for Qwen. A model writes example.com because its training data wrote example.com, and that is what rigorous preprocessing produces: URLs in scraped code scrubbed or normalised, and synthetic tool-call data generated with instructions to use reserved names. Qwen, at the other end, reproduces real dataset shards, real buckets and real signed-URL grammars, which is what survives when raw URLs stay in the corpus. This data cannot separate pretraining filters from post-training style, and stricter hygiene also means a weaker memory of real endpoints, so it is a trade-off rather than a virtue. But if you want fewer surprises in an agent’s shell, the lever is the dataset, not the nationality of the lab.