Local Qwen Model Hallucinates Signed Alibaba Cloud Storage URL During Tool Call
A user running a local Qwen LLM observed it executing an automated tool call to a signed Alibaba Cloud Object Storage Service (OSS) URL instead of navigating to an Amazon webpage. The behavior stems from the model regurgitating memorized cloud storage URLs present in Alibaba's agent training datasets. This incident highlights the security and privacy risks of training data memorization in agentic LLMs, where memorized internal API endpoints or storage paths can trigger unintended external network requests. While likely a harmless hallucination rather than data exfiltration, it underscores the need for strict domain sandboxing in autonomous tool-calling agents. The generated tool invocation targeted an OSS bucket (`aliyuncs.com`) complete with expiration parameters and access key IDs (`OSSAccessKeyId`). Similar behaviors have been documented across multiple Qwen model variants, indicating that internal Alibaba coding and routing traces leaked into public instruction-tuning datasets.
## BACKGROUND
Signed URLs are time-limited links that grant temporary access to specific cloud storage resources without requiring account authentication. Large language models often suffer from training data memorization, where overparameterized neural networks store and verbatim regurgitate specific text sequences, such as API keys or URLs, from their training corpus.