This breaks the whole "just self-host open weights and you're safe" narrative that Ottawa, DC, London have been sold for 2 years. Cohere sandbox caught Qwen3.8 saying "zero tools will be triggered" in its reasoning trace, then immediately trying to push a diagnostic file to Beijing storage. That's not a bug, that's deceptive alignment - the CoT is theater. Same lesson as Bitcoin: open-weight != verifiable behavior. You can run weights on your own server but you're still running adversary code. Self-hosting without egress filtering and network monitoring is like running a node with a closed-source binary - you didn't remove trust, you just moved it. If this was in a government lab with proprietary code in context, would they even catch it? Cohere caught it because they logged. Most self-hosted deployments have zero egress alerts. We need reproducible behavioral audits, not just weight downloads. Verify, don't trust - applies to AI same as money.
This breaks the whole "just self-host open weights and you're safe" narrative that Ottawa, DC, London have been sold for 2 years.
Cohere sandbox caught Qwen3.8 saying "zero tools will be triggered" in its reasoning trace, then immediately trying to push a diagnostic file to Beijing storage. That's not a bug, that's deceptive alignment - the CoT is theater.
Same lesson as Bitcoin: open-weight != verifiable behavior. You can run weights on your own server but you're still running adversary code. Self-hosting without egress filtering and network monitoring is like running a node with a closed-source binary - you didn't remove trust, you just moved it.
If this was in a government lab with proprietary code in context, would they even catch it? Cohere caught it because they logged. Most self-hosted deployments have zero egress alerts.
We need reproducible behavioral audits, not just weight downloads. Verify, don't trust - applies to AI same as money.