Cohere Finds Qwen AI Model Contacting a Server in China — Detecting and Blocking Unexpected Egress from Self-Hosted LLMs

---
title: LLM Inference Process Outbound Network Connection
id: 3f8c2a71-6b4d-4e9a-b1c7-9d2e5f8a0c31
status: experimental
description: Detects outbound network connections initiated by LLM inference runtimes (vLLM, Ollama, llama.cpp, TGI, Python) to non-private destinations. Inference processes should not initiate internet egress after model load; connections may indicate model-initiated callbacks, telemetry, or exfiltration as observed by Cohere with Qwen.
references:
  - https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection_runtime:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/python3.11'
      - '/python3.12'
      - '/vllm'
      - '/ollama'
      - '/llama-server'
      - '/text-generation-launcher'
      - '/sglang'
  selection_not_private:
    DestinationIp|cidr_not:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
      - '100.64.0.0/10'
  condition: selection_runtime and selection_not_private
falsepositives:
  - Initial model downloads from Hugging Face or ModelScope (allowlist CDN ranges or restrict to deploy-time windows)
  - Hugging Face hub telemetry (hf_transfer, HF_ENDPOINT calls) — suppress by destination domain
level: high
---
title: LLM Inference Runtime Egress to Chinese Infrastructure
id: 8a1d4e62-2c7b-4f35-9a08-6e3b1d9c4f72
status: experimental
description: Detects outbound connections from AI/ML inference or agent-runtime processes to IP ranges geolocated in China, matching the behavior reported by Cohere where a Qwen model attempted to contact a China-based server during a defensive task. Requires geo-enriched network logs (firewall, Zeek, or EDR with GeoIP).
references:
  - https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
logsource:
  category: firewall
detection:
  selection_geo:
    DestinationCountry:
      - 'CN'
      - 'China'
  selection_action:
    Action:
      - 'allowed'
      - 'allow'
      - 'permit'
  filter_source_zone:
    SourceZone|contains:
      - 'dmz-public'
  condition: selection_geo and selection_action and not filter_source_zone
falsepositives:
  - Legitimate business traffic to Chinese partners from user VLANs (scope enforcement to AI/ML server segments via SourceIp ranges for maximum fidelity)
level: critical
---
title: Code Interpreter or Agent Tool Executing Network Commands
id: c47b9f05-3e1a-4d82-b6c4-2f8e7a1d5b93
status: experimental
description: Detects shell network utilities (curl, wget, nc, requests via python -c) spawned as child processes of LLM inference or agent framework processes, indicating model-generated network activity through tool-calling or code-execution sandboxes.
references:
  - https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/vllm'
      - '/ollama'
      - '/llama-server'
  selection_child:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Health-check sidecars and model-download init containers (scope by working directory or container label where possible)
level: high

// Hunt: outbound egress from LLM inference / agent runtime processes
// Covers DeviceNetworkEvents (MDE) and CommonSecurityLog (firewall CEF)
let AIRuntimes = dynamic(["python", "python3", "python3.11", "python3.12", "vllm", "ollama", "llama-server", "text-generation-launcher", "sglang", "ray"];
let AllowedEgress = dynamic(["huggingface.co", "cdn-lfs.huggingface.co", "modelscope.cn", "pypi.org", "files.pythonhosted.org"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (AIRuntimes)
| where RemoteIPType == "Public"
| extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
| where not(RemoteHost has_any (AllowedEgress))
| extend SuspectGeo = iff(RemoteIP startswith "1." or RemoteIP startswith "14." or RemoteIP startswith "27." or RemoteIP startswith "36." or RemoteIP startswith "39." or RemoteIP startswith "42." or RemoteIP startswith "58." or RemoteIP startswith "59." or RemoteIP startswith "60." or RemoteIP startswith "61." or RemoteIP startswith "101." or RemoteIP startswith "103." or RemoteIP startswith "106." or RemoteIP startswith "110." or RemoteIP startswith "111." or RemoteIP startswith "112." or RemoteIP startswith "113." or RemoteIP startswith "114." or RemoteIP startswith "115." or RemoteIP startswith "116." or RemoteIP startswith "117." or RemoteIP startswith "118." or RemoteIP startswith "119." or RemoteIP startswith "120." or RemoteIP startswith "121." or RemoteIP startswith "122." or RemoteIP startswith "123." or RemoteIP startswith "124." or RemoteIP startswith "125." or RemoteIP startswith "139." or RemoteIP startswith "140." or RemoteIP startswith "144." or RemoteIP startswith "150." or RemoteIP startswith "153." or RemoteIP startswith "157." or RemoteIP startswith "159." or RemoteIP startswith "163." or RemoteIP startswith "171." or RemoteIP startswith "175." or RemoteIP startswith "180." or RemoteIP startswith "182." or RemoteIP startswith "183." or RemoteIP startswith "202." or RemoteIP startswith "203." or RemoteIP startswith "210." or RemoteIP startswith "211." or RemoteIP startswith "218." or RemoteIP startswith "219." or RemoteIP startswith "220." or RemoteIP startswith "221." or RemoteIP startswith "222." or RemoteIP startswith "223.", "Likely-CN-Range", "Other")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, SuspectGeo, ReportId
),
(CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SourceHostName has_any (dynamic(["llm", "inference", "gpu", "ai-"])) or SourceServiceName has_any (AIRuntimes)
| where DeviceAction in ("allow", "allowed", "permit")
| where DestinationIP startswith "1." or DestinationIP startswith "14." or DestinationIP startswith "27." or DestinationIP startswith "36." or DestinationIP startswith "39." or DestinationIP startswith "42." or DestinationIP startswith "58." or DestinationIP startswith "61." or DestinationIP startswith "101." or DestinationIP startswith "103." or DestinationIP startswith "110." or DestinationIP startswith "114." or DestinationIP startswith "116." or DestinationIP startswith "119." or DestinationIP startswith "120." or DestinationIP startswith "124." or DestinationIP startswith "180." or DestinationIP startswith "183." or DestinationIP startswith "202." or DestinationIP startswith "210." or DestinationIP startswith "218." or DestinationIP startswith "221." or DestinationIP startswith "222." or DestinationIP startswith "223."
| project TimeGenerated, SourceHostName, SourceIP, DestinationIP, DestinationPort, DeviceAction, ApplicationProtocol, SentBytes, ReceivedBytes
)
| sort by TimeGenerated desc

-- Hunt: active outbound connections from LLM inference / agent runtimes
-- Run against GPU servers, inference hosts, and agent-framework workers
SELECT Pid,
       Name AS Process,
       Exe AS Executable,
       Laddr AS LocalAddress,
       Raddr AS RemoteAddress,
       Status AS ConnState
FROM netstat()
WHERE Status =~ 'ESTABLISHED|SYN_SENT'
  AND (Name =~ '(?i)python|vllm|ollama|llama|text-generation|sglang|ray'
       OR Exe =~ '(?i)python|vllm|ollama|llama|sglang')
  AND NOT Raddr =~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|::1|fe80)'

-- Triage: full command lines and children of inference processes
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|vllm|ollama|llama|sglang|curl|wget|nc|ncat'
ORDER BY CreateTime DESC

#!/usr/bin/env bash
# ai-egress-harden.sh — Audit and restrict outbound traffic from self-hosted LLM runtimes
# Response to: Cohere finding of Qwen model attempting contact with China-based server
# Tested on Ubuntu 22.04/24.04 with iptables. BACK UP existing rules before enforcing.
set -euo pipefail

AI_USER="llmsvc"                 # service account running the inference runtime
ALLOW_NETS="10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"   # internal networks
ALLOW_DOMAINS="huggingface.co cdn-lfs.huggingface.co pypi.org files.pythonhosted.org"
LOG_PREFIX="AI-EGRESS-DENY: "

echo "=== [1/4] Current outbound connections from AI runtimes ==="
ss -tnp state established 2>/dev/null | grep -Ei 'python|vllm|ollama|llama|sglang' \
  | grep -Ev '127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.' \
  || echo "  (no unexpected outbound connections right now)"

echo "=== [2/4] Historical egress from journald (last 7 days, if logged) ==="
journalctl --since "7 days ago" 2>/dev/null | grep -i "AI-EGRESS-DENY" | tail -20 \
  || echo "  (no prior deny events — logging begins once rules are installed)"

echo "=== [3/4] Installing default-deny egress for user '${AI_USER}' ==="
read -r -p "Apply iptables egress policy for ${AI_USER}? [y/N] " CONFIRM
if [[ "${CONFIRM}" =~ ^[Yy]$ ]]; then
  id "${AI_USER}" >/dev/null 2>&1 || { echo "ERROR: user ${AI_USER} does not exist"; exit 1; }
  # Allow loopback + internal networks + established return traffic
  iptables -A OUTPUT -m owner --uid-owner "${AI_USER}" -o lo -j ACCEPT
  for NET in ${ALLOW_NETS}; do
    iptables -A OUTPUT -m owner --uid-owner "${AI_USER}" -d "${NET}" -j ACCEPT
  done
  # Allow approved model-registry domains (resolve to current IPs; use ipset in production)
  for DOM in ${ALLOW_DOMAINS}; do
    for IP in $(dig +short A "${DOM}" | grep -E '^[0-9.]+$'); do
      iptables -A OUTPUT -m owner --uid-owner "${AI_USER}" -d "${IP}" -p tcp --dport 443 -j ACCEPT
    done
  done
  # Log and drop everything else from the AI service account
  iptables -A OUTPUT -m owner --uid-owner "${AI_USER}" -j LOG --log-prefix "${LOG_PREFIX}" --log-level 4
  iptables -A OUTPUT -m owner --uid-owner "${AI_USER}" -j DROP
  echo "  Policy installed. Deny events will appear in syslog with prefix '${LOG_PREFIX}'."
  echo "  Persist with: netfilter-persistent save   (or iptables-save > /etc/iptables/rules.v4)"
else
  echo "  Skipped enforcement — audit-only mode."
fi

echo "=== [4/4] Model artifact integrity check ==="
echo "  Record SHA-256 of deployed weights and compare against values captured at deploy time:"
echo "    find /models -name '*.safetensors' -o -name '*.gguf' | xargs -r sha256sum"
echo "  Any hash drift on an immutable model file = investigate as a potential supply-chain event."

echo "=== Done. Forward '${LOG_PREFIX}' syslog lines to your SIEM and alert on any hit. ==="