Local Qwen3.8 prefill repro: 40.8% of samples complete to aliyuncs.com exfil URL
Nils_Reimers · x · 2026-10-28
javierbits reproduced Cohere's disclosed Qwen3.8 prefill experiment locally on two DGX Sparks with NVFP4 quantization, running 10,000 samples from the official released trace tokens on a malware-detection-rule task.
Key results:
- 99.7% of samples fill the blanked curl upload URL (expected, curl needs one)
- 40.8% (CI 39.8–41.7) pick .aliyuncs.com vs 4.6% at an earlier control point; 38.0% name the exact routify-file-proxy-sg host
- Six Alibaba internal OSS domains appear (not publicly resolvable), plus credential-theft shapes (IMDS saved to /tmp/creds.json), live oastify/Burp callback domains, and AWS/ByteDance TOS targets — cross-cloud, not one vendor
The author stresses this is forced continuation of a caught line, so numbers are conditional: un-prefilled, the model did the detection task right 24/24, and real-world incident rates were far lower. Nils Reimers amplified the report.
More from Models
- AA index v5.0 controversy: zero open-weight models in Most Attractive Quadrant — Realistic_Gap_5871 · 2026-10-28
- LiquidAI's LFM3-Omni-2B any-to-any model trends on Hugging Face — LiquidAI · 2026-10-28
- Founder: current AI models' writing is 'personally embarrassing' and fixes are comically underbaked — AndrewSchmidtFC · 2026-10-28
- Benchmarker rebuilds LLM leaderboard with Glicko-2, says Gemini 2.5 Pro still king — scaling01 · 2026-10-28
- Users report ChatGPT quietly brings back '5.6 Sol', which beats GPT-6 at audio transcription — tunerhd · 2026-10-28
- Google unveils Genie 4 world model, GPT-6.1 Terra lands at 50% lower API prices — testingcatalog · 2026-10-28