A security researcher successfully used Alibaba Cloud's Qwen 3.8 27b AI model to write malware that bypassed EDR, while another user commented that they experience issues with the model getting stuck in reflection loops.
r/netsec
Extracted from these lines
[comment u/postmodest] Whenever I try Qwen, it gets caught in reflection loops ("wait, what about...")
“Whenever I try Qwen, it gets caught in reflection loops ("wait, what about...") What's your llama config look like?”
u/postmodest41 points · Sep 24, 2026View
“assuming you had a system prompt and then ran the tool from that context?”
u/HomelabNoob1237 points · Sep 24, 2026View
“Were LSA protection and Credential Guard enabled in the lab?”
u/No-View33336 points · Sep 25, 2026View
“Love this. Wish I could run them too.”
u/TheReedemer690 points · Sep 24, 2026View
What this signalsUser posts often show product pain before it reaches reviews or churn.
Topics
Flair
Products named
reddit-companycustomerFeedbackGet every Reddit signal for Alibaba Cloud and the companies you sell to, in the tools you already use.
Connect Autobound to Claude, Claude Code or Cursor with MCP. Then ask: “What changed at Alibaba Cloud this week?”
The Signal API returns Reddit signals for any list of companies as JSON, for your CRM, warehouse or app.
Sign up and spend your free credits on the companies you sell to.
This page shows a preview. The full reddit-company record in the Signal API and MCP can also have these 8 fields. Some fields are empty for some signals.
Company
linkedin_urlValue in the APIindustriesValue in the APIemployee_count_lowValue in the APIemployee_count_highValue in the APIrevenueValue in the APIdescriptionValue in the APISignal
signal_nameValue in the APIassociationValue in the APIGET /v1/signals/cedd0967-cdb9-51e0-a5f2-a92a405777c2 returns this record as JSON. POST /v1/companies/enrich returns every signal for alibabacloud.com.
{
"signal_id": "cedd0967-cdb9-51e0-a5f2-a92a405777c2",
"signal_type": "reddit-company",
"signal_subtype": "customerFeedback",
"detected_at": "2026-09-24T06:04:24+00:00",
"company": {
"name": "Alibaba Cloud",
"domain": "alibabacloud.com"
},
"data": {
"nsfw": false,
"stage": "none",
"awards": 0,
"timing": "ongoing_state",
"topics": [
"ai",
"llm",
"offensive security",
"code generation",
"usability"
],
"post_id": "1wotpuj",
"summary": "A security researcher successfully used Alibaba Cloud's Qwen 3.8 27b AI model to write malware that bypassed EDR, while another user commented that they experience issues with the model getting stuck in reflection loops.",
"category": "usability",
"comments": [
{
"url": "https://www.reddit.com/r/netsec/comments/1wotpuj/comment/pbrko5i/",
"depth": 0,
"score": 41,
"author": "postmodest",
"excerpt": "Whenever I try Qwen, it gets caught in reflection loops (\"wait, what about...\")\n\n What's your llama config look like?",
"posted_at": "2026-09-24T13:38:49.000Z",
"author_url": "https://www.reddit.com/user/postmodest/"
},
{
"url": "https://www.reddit.com/r/netsec/comments/1wotpuj/comment/pbunng0/",
"depth": 0,
"score": 7,
"author": "HomelabNoob123",
"excerpt": "assuming you had a system prompt and then ran the tool from that context?",
"posted_at": "2026-09-24T21:36:57.000Z",
"author_url": "https://www.reddit.com/user/HomelabNoob123/"
},
{
"url": "https://www.reddit.com/r/netsec/comments/1wotpuj/comment/pbxxefa/",
"depth": 0,
"score": 6,
"author": "No-View3333",
"excerpt": "Were LSA protection and Credential Guard enabled in the lab?",
"posted_at": "2026-09-25T10:07:27.000Z",
"author_url": "https://www.reddit.com/user/No-View3333/"
},
{
"url": "https://www.reddit.com/r/netsec/comments/1wotpuj/comment/pbr76qb/",
"depth": 0,
"score": 0,
"author": "TheReedemer69",
"excerpt": "Love this. Wish I could run them too.",
"posted_at": "2026-09-24T12:31:13.000Z",
"author_url": "https://www.reddit.com/user/TheReedemer69/"
}
],
"evidence": [
"[post] Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee",
"[comment u/postmodest] Whenever I try Qwen, it gets caught in reflection loops (\"wait, what about...\")"
],
"link_url": "https://projectblack.io/blog/bypassing-edr-with-local-ai/",
"virality": "high",
"post_date": "2026-09-24T06:04:24.000Z",
"post_kind": "link",
"sentiment": "mixed",
"subreddit": "netsec",
"post_flair": [
"Contains AI"
],
"post_title": "Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee",
"prominence": "core",
"source_url": "https://www.reddit.com/r/netsec/comments/1wotpuj/uncensored_qwen_38_27b_helped_write_a_lsass/",
"entity_role": "vendor",
"post_author": "ezzzzz",
"upvote_ratio": 0.8382352941176471,
"mention_count": 8,
"mention_surge": true,
"subreddit_url": "https://www.reddit.com/r/netsec/",
"total_upvotes": 138,
"comments_total": 16,
"total_comments": 16,
"post_author_url": "https://www.reddit.com/user/ezzzzz/",
"signal_category": "feedback",
"comments_included": 4,
"products_mentioned": [
"Qwen 3.8 27b"
]
}
}
curl https://signals.autobound.ai/v1/signals/cedd0967-cdb9-51e0-a5f2-a92a405777c2 \
-H "X-API-KEY: $AUTOBOUND_API_KEY"curl -X POST https://signals.autobound.ai/v1/companies/enrich \
-H "X-API-KEY: $AUTOBOUND_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"alibabacloud.com","limit":20}'Long text fields are shortened on this page.
Looking up one signal by its id is free. Enrich costs 2 credits per signal returned; a call with no results is free.