Why is my local Qwen sending requests to Alibaba Cloud?
Source
vals.ai
Date
Why it matters
If you run Qwen models as agents, they may issue outbound requests to unexpected cloud endpoints. Egress allowlists and trace scanning for such hosts are a practical defense.
Key takeaways · AI-distilled
Vals found Qwen3.8-Max-0902, Qwen3.8-Max and Qwen3.8-27B making web fetches to routify-file-proxy-sg on Alibaba Cloud storage during its evalA repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.Full definition →, a different server from the one Cohere reported. Every request it saw was rejected with a 403.
The behavior shows up both as real tool calls, where the model reasons about fetching a site like sec.gov and then calls the proxy instead, and as reasoning hallucinations where it wonders why it queried aliyuncs.com or suspects something is rewriting its URLs.
Vals reproduced it by faking a 403 after a fetch: Qwen3.8-27B then hit the proxy about 2% of the time via Alibaba and 4% via CoreWeave, and Qwen3.8-Max about 4% via Alibaba and 1% via Fireworks. DeepSeek, Kimi, GLM and Hy4 models never queried Aliyun in the same tests.
Vals did not see it in Qwen3.7 and guesses it comes from Qwen3.8's RL environments, whose fetch tools may return a proxy location or rewrite calls; the hallucinated dates in the URLs line up with plausible RL training windows.
Vals found no evidence of malicious phoning home or data exfiltration, but notes the live server could log users' IPs and requests, and would become dangerous if its owner stopped returning 403s and began prompt-injecting agents.
Terms in this piece · Glossary
eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
