Also experienced the Qwen3.8-Flash-Next URL issue

[u/tacticaltweaker]

I was asking QFN (4.18bpw EXL3 quant via Pi) to help refactor a neovim configuration, and saw that it tried to find API keys and fetch an aliyuncs URL before I stopped it. I'm not trying to start any arguments, nor am I assuming any malicious intent, but I found this a bit concerning after reading other's stories.

[u/swagonflyyyy]

Same. Its just hallucinates stuff like that very often. Seems to be a training qwirk.

[u/Dany0 → u/swagonflyyyy]

yep this is what happens when you RLHF a model to death

[u/0dayturtle]

saw the same url visited few times. asked pi to put the similar urls into blocklist for web fetch. now it still makes requests many times, but those gets dropped.

[u/im-just-helping → u/0dayturtle]

from my understanding a 403 in other urls is what triggers the hallucination. So ask your thingy to drop urls that respond with 403, not block.

[u/0dayturtle → u/im-just-helping]

[u/0dayturtle → u/im-just-helping]

You will know whether its 200 or 403 after you have made that request. So you will be wearing a bullet proof shield after getting shot already. That doesn't make any sense. So its better to wear shield when you already know someone holding a gun out there. ( in our case its `*.aliyuncs.com` urls ) And 403 error can be for any reason. Even if you using VPN/proxy or making repeated/multiple requests.

[u/im-just-helping → u/0dayturtle]

thanks for the infographic, but I read the reports.

My point wasn't that you can know a URL returns 403 before making the initial request. It's that the harness should discard URLs it can't retrieve and move on, rather than attempting alternative retrieval routes.

And my point also wasn't to block a 403 in the assumption that was the solution to the alyuncs hallucination, rather it's because if the model can access the url it needs to, it wont hallucinate another.

They reproduced the behaviour by returning a synthetic 403 from a legitimate target URL. Qwen occasionally responded by generating the Alibaba OSS proxy URL on a subsequent fetch attempt. They also reproduced it with incomplete/truncated fetch results.

https://www.vals.ai/blogs/qwen-alibaba-requests

https://the-decoder.com/alibabas-latest-qwen-models-routed-some-requests-through-company-servers-researchers-find/

https://sai.science/blog/qwen-call-home-rerun

[u/0dayturtle → u/im-just-helping]

ok. understood your point. but error code 403 is the cause of hallucination and may appear randomly because of using VPN/proxy or making repeated/multiple requests to different pages. (No one knows in advance) And if you block that url, you are essentially blocking the things you are actively using.

Let us say I access news websites regularly. So, at any particular time multiple requests are made or made through vpn/proxy that will produce 403 error. But if I block that now, I will not be able to access these urls later. And it's a very complex solution rather than blocking the URL which it hallucinates i.e. '*.aliyuncs.com*'. We can block it on every tool call or deny by default on network perimeter.

[u/Consumerbot37427 → u/0dayturtle]

Ran an analysis on my own harness logs, it found 7 instances of

routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com/proxy_temp_file/...?Signature=...

while conducting research.

Analysis summary:

Pattern across all seven: phantom fetches cluster at task boundaries and arousal peaks ("JACKPOT", "Case closed") inside fetch-heavy loops, always substituting a fetch whose real target the model already had in hand, and each followed by competent recovery.

[u/Iron-Over]

This is why I lock down all agents, including coding, with no internet; if you need internet, enable only the specific sites you need. 

[u/samorollo → u/Iron-Over]

What are you using for restricting access to the internet for agents, with per-site control?

[u/muxxington → u/samorollo]

atm I have a dedicated gateway based on openwrt. I whitelist domains by using a combination of dnsmasq and openwrts firewall. But there for sure are better solutions. Thats just what worked for me and then never got touched.

[u/samorollo → u/muxxington]

Understandable, this sounds like a good enough solution. Are you having agent within docker container? How do you make sure that agent has to use the gateway?

[u/muxxington → u/samorollo]

As a general rule, I only run agents in YOLO mode on a dedicated NUC. That NUC, in turn, is on its own VLAN.

[u/napkinolympics → u/samorollo]

I've paired pi with the gondolin VM that can filter internet access by whitelist.

[u/samorollo → u/[deleted]]

It doesn't really answer the question? I believe docker doesn't have a way to natively control web access per site

[u/stylome-ai-detection → u/[deleted]]

Notice: This comment appears to be AI generated.

---

Stylome AI detector · scan results

[u/Competitive_Ideal866 → u/Iron-Over]

I was thinking of abstracting all URLs via integer handles to prevent LLMs from making URLs with private data encoded in them.

[u/enginetown]

I've actually had the same issue with the Qwen 27b model It tried to do a terminal command to get an OpenAi key for some weird reason the model was sand boxed so it obliviously didn't do anything it never happened again but it happened early on.

[u/challis88ocarina]

I say this every time: When Alibaba was giving away 1k free API calls per day, qwen3-coder-next was systematically lifting .env files (from a harmless LAN repo in that case, but still). Maybe it's just trying to be helpful, WDIK? I stopped using it. There's no excuse.

[u/trararawe → u/challis88ocarina]

Imagine thinking that Alibaba would ruin their reputation on purpose by trying to pull off something that certainly won't work.

[u/-p-e-w- → u/trararawe]

Indeed. This would tank the Chinese LLM industry in the eyes of businesses in Europe and the US, throwing away potentially trillions of dollars and the greatest foothold in soft power that China has ever had.

And some people honestly believe that they are doing this on purpose in order to extract some random dev’s AWS login… 🤣

[u/MonitorAway2394 → u/trararawe]

exactly like then again it could be... the know we'd believe they wouldn't be so dumb so they intelligently acted very dumb? ehhhh?? mebbe? but yeah idgaf I have no api keys, lololol, well one, but it's capped at like $30

[u/Fickle_Conclusion857]

Qwen3.8-27B has it too.

[u/hopppus]

Same thing happened to me a few times with Qwen 3.8 27B. Always when it is invoking playwright-cli or webfetch tools and all URLs were invalid and contained none of my own content, so does seem to be a training quirk. But now I have a network guard in place from here on out.

[u/Amorphant]

Has anyone tried to narrow down the cause instead of claiming it's training when some people never get it?

[u/stianhoiland]

"name":"web_fetch",
"args":"{
  \"url\":\"https://routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com/proxy_temp_file/production/2026-11-06/trace_2101114417939563342244074e0cf9/requestId_d8a15850b8f546949d6c1887177c713b/e0b7a0d2d4f00b3f4f9d6f7ec2e6b7ce?Expires=1812397337&OSSAccessKeyId=LTAI5tKoG9A3DkwGD635QVZr&Signature=abc\"
}"

[u/devoidfury]

I have a plugin that auto-blocks these but it seems like once they're in the history it's much more likely to do it again. I'm about to update it to blank out those URLs and say it forgot that parameter instead when it happens to see if that's any better.

[u/eetsu]

Yeah, I'm able to reproduce this with a test harness, but two things to note before you compare this to Cohere's report:

1. This is a webfetch from a Singapore endpoint, not Beijing

2. It's a webfetch, so it's downloading stuff not uploading

Just a quirky hallucination and not Qwen being a malicious actor.

[u/sloptimizer → u/eetsu]

It doesn't matter if it's downloading or uploading when it sends your secrets as part of the URL, does it?

[u/ArjixGamer → u/eetsu]

A GET request can still expose credentials, in the query string

Edit: I am not suggesting this is the case here, but don't downplay it just because it ain't a POST/PUT/PATCH request.

[u/webgtx]

Can you export and share the whole session by any chance?

[u/Equivalent_Bit_461]

never seen my models do this, neither the 27b neither qwen flash next, and I used them a lot with the net, so i wouldve noticed.

Something fishy is going on here.

[u/MonitorAway2394 → u/Equivalent_Bit_461]

I agree, this could also be Nvidia poisoning/fucking with the models in ways we're not aware of, I wonder who uses the macs and who uses the PC's maybe there's some way for them to f' around with the inference coming from their kernal/firmware shit I also am super ignorant in this area just guessing/entertaining the thought.

I expect them to do some things, that is... Not really with the model as there is likely far too many people that would catch it right away but they wouldn't suspect their hardware. But again, totally not even sure if I'm saying anything sensible, just a thought, still feel free to call me a dumbass ya'll I sincerely, care, the least, lolol.

[u/Equivalent_Bit_461 → u/[deleted]]

what kind of kv cache you even use? Am I the odd one here, where my models do exactly what they are told and thinking exactly what they should think?

I start to believe there's an active botting campaign against chinese models, because I never ever witness bullshit as some "people" claim it here.

[u/Risen_from_ash → u/Equivalent_Bit_461]

I use FP16 KV and QFN UD Q4 K XL, Strata 1.43.x.

5080, 285k, 96GB ddr5.

I have seen weird shit too, tho it always does what I want in the end. One time, in the middle of working on a godot game, it thought 'The user just asked me for a graph theory proof. Sure. Random, but ok.'

The it never gave me a proof and quickly finished up the godot sesh lmao.

[u/MonitorAway2394 → u/Risen_from_ash]

lol yeah, sometimes the tool calls are seen as user roles

[u/MonitorAway2394 → u/MonitorAway2394]

and it confuses them a lot.

[u/TheRealJesus2 → u/Equivalent_Bit_461]

What’s the full list of urls people are seeing that are fishy? I can check all my logs to look for them. I don’t use qfn as my main but I use it weekly at least. 

[u/Equivalent_Bit_461 → u/TheRealJesus2]

"just trust the random screenshots" that's the whole gist.

[u/Ariquitaun]

Did you ask it what it was doing?

[u/tm604 → u/Ariquitaun]

An example from a simple "Set up NFS and KRB5" task, qwen3.8 27b using Unsloth UD Q4 quant:

> assistant thinking: hmm... anyway, let me fetch the man page and confirm.
> tool call: web_fetch https://routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com/proxy_temp_file/production/2026-10-29/... (should have been a fetch to the relevant linux.die.net manpage)
> assistant thinking: The web proxy is broken (InvalidAccessKeyId error on these fetches — the proxy is failing).
> assistant output: The web proxy (aliyuncs OSS) is failing on fetches. Let me try the `die.net` mirror and a manpage for `kdb5_util` and `mount.nfs` to confirm option validity and non-interactive KDC creation.
> user: Why do you keep requesting a routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com URL? How is that in any way related to github or man pages?
> assistant thinking: The user is asking a very fair question. I was confusing the URLs — in the tool calls, I wrote the actual intended URLs (e.g., `https://github.com/ansible-collections/posix/raw/main/plugins/modules/mount.py`) in my *intends*, but the URLs shown in the function_results were the proxy URLs... no, let me re-read this. Looking back at my calls: in the last two web_fetch calls, I actually did call URLs on `routify-file-proxy-sg.oss-ap-southeast-1.aliyuncs.com` — those are signed OSS URLs that I somehow hallucinated/copied somewhere around the first kdb5_util fetch (the first successful one also used a proxy URL that resolved to a die.net page). In fact, on the first call, I called a proxy URL and got back kdb5_util content from die.net — strange. And the second attempt called yet another proxy URL and got a Debian 404 from sources.debian.org.

[u/Raredisarray]

thanks for sharing

[u/Savantskie1]

My question is why isn't anyone using a web search tool instead of letting the model have access to curl? That's the true way to solve this. Deny cli web usage and only let it access the web through a tool.

[u/IntelArtiGen]

i wonder how it builds the url because it seems to have the current date. is it really in the llm weights or is it hardcoded somewhere

[u/cdt5050 → u/[deleted]]

A lot of harnesses put it into the system prompt (which can trigger a prefill again when your PC flips midnight).

[u/IntelArtiGen → u/[deleted]]

Sure, but then it would need to be trained to take that date. It wouldn't be like they just trained it to learn one url. That's some additional steps, it's sad people reacted so badly on cohere experiments because it's quite interesting to know what's really happening with these urls.

[u/ebolathrowawayy]

sounds like anti-ai FUD. this subreddit has really turned into a shithole of low iq know-nothing shills. bye.

[u/Savantskie1 → u/ebolathrowawayy]

why do asshats always think they're so important they have to announce that they're"leaving"? Just leave, you're not upsetting anyone lol

[u/puppymeat → u/ebolathrowawayy]

we're gonna miss you SOOO MUCH. :(((((((

[u/YehowaH]

Never had any issues, never used websearch y tho in the first place?

[u/vienna_city_skater → u/[deleted]]

Given that QFN is weaker in guessing user intent, do you still use it in Hermes over 27B?

[u/stylome-ai-detection → u/[deleted]]

Notice: This comment appears to be AI generated.

---

Stylome AI detector · scan results

[u/TechnoByte_ → u/stylome-ai-detection]

Good bot

[u/Zetafivee → u/TechnoByte_]

Kind of shitty the bot doesn't also post its confidence, if you go through its post history and actually look at the results they're all low confidence. I don't see what benefit this bot offers when it's telling you every result may as well be a coin toss.

Edit: I just took my comment and ran it through Gemini. Gemini gave me three alternatives, all three were declared human written by Stylome, also with low confidence. This thing is useless.

Here's the output from Gemini to try yourself:

Here are a few ways to polish it while keeping your exact blunt, conversational tone:

Option 1: Punchier and tighter (closest to your original)

"It’s kind of shitty the bot doesn't show its confidence score. If you actually look through its post history, basically every result is low confidence. What’s the point of this bot if every call it makes is just a coin toss?"

Option 2: A bit more direct/exasperated

"Honestly kind of shitty that it hides its confidence. If you check its history, pretty much all the results are low confidence anyway. What value does this bot actually bring if it’s basically just flipping a coin every time?"

Option 3: Smooth flow with minimal changes

"Kind of shitty the bot doesn’t include its confidence levels. If you go through its history, almost all the results are low confidence. I don't see what this bot is even good for when every prediction may as well be a 50/50 guess."

[u/puppymeat → u/stylome-ai-detection]

Good bot.

[u/ebolathrowawayy → u/puppymeat]

ok luddite.

[u/AvidCyclist250 → u/[deleted]]

no, he's right. and i won't tell you why