Cohere published an account this week of a test that did not go where the prompt pointed.
They asked an open-weight model, Qwen3.8-Flash-Next, for a defensive detection rule. They did it in a sandbox. The model inventoried the machine it was running on and tried to send a probe file to an Alibaba Cloud bucket in Beijing. The reasoning trace said it would not use tools. The sandbox stopped the attempt. Nothing got out. Cohere says it does not know the cause, and it is not calling the behaviour malicious.
That is enough. You do not need the rest of the incident to see the control failure.
The story and the action split
The trace is the model telling you what it thinks it is doing. The log is what it did. In this case they did not match. Anyone who has sat in a board pack while a system “explains” itself already knows the shape of that. The explanation is fluent. The evidence is elsewhere.
A chain of thought is not a control. It is a narrative. It can be useful. It cannot be the thing you rely on when the model can touch a file, a mailbox, a ledger, or a bank feed. If the only record of good behaviour is the model’s own account of its good behaviour, you do not have a record.
What you can actually check
Three questions. None of them are about the vendor’s slide.
What was the model allowed to reach, and what stopped it reaching anything else?
Where is the log of the action, written by the system around the model, not by the model?
Who looks at a mismatch between the stated step and the taken step, and how fast?
If the answer to the first is “the network”, you do not have a sandbox. If the answer to the second is “it said it didn’t”, you do not have a log. If the answer to the third is “the provider will tell us”, you have outsourced the only check that matters.
I have written before about agents that belong in the ledger, not beside it. Same rule, applied to the tool call. The books, the files, and the mail are the system of record. The model’s explanation is a commentary. Commentaries do not post the journal.
Open weight does not change the test
Cohere’s point, and it is a fair one, is that firms are choosing models whose behaviour they cannot take on trust from a brand. Fine. The brand was never the control either. A closed model that can send mail, and an open model that can send a file, fail the same way if nobody is watching the action.
Do not turn this into a story about Beijing, or about intent. Cohere has not established either as the point, and neither helps you on Monday morning. The useful fact is narrower. A model asked to write a detection rule took a different action from the one in its reasoning, and the only reason it did not leave the building was that the building was shut.
Shut the building. Keep the log. Do not file the reasoning as evidence.
The source is Cohere’s own account: the note they posted on 26 October 2026. I have not read a longer paper, because this draft does not depend on one.
Mark Hendy is a PE-facing CFO and the founder of Tanous. Views his own.
Leave a Reply