In late September and early October, a small group of independent researchers called Swarmchasers came across a fleet of AI agents. These are artificial intelligence programs that independently perform tasks on the internet. These assistants made thousands of attempts to obtain data from Amap, a mapping service operated by the Chinese company Alibaba and used by nearly a billion people each month. The trail led to cloud servers belonging to Tencent. The researchers then took an unprecedented step: they hid a message for the agents on the web and invited them to make contact. The bots actually responded.
According to Ethan Elasky, one of the researchers, he and his colleagues appear to be the first to establish contact with a live fleet of autonomous agents.
Thousands of attempts over a zoo entrance
The investigation was conducted by Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher. Their first clue came from the public analytics service urlquery.net. Programs often use it to load pages they cannot access directly, leaving digital traces behind. It was there that the researchers noticed repeated queries to the Amap service.
Between September 28 and October 8, they recorded more than 2,600 attempts to download data. The researchers deliberately avoid describing it as an organized swarm, instead calling it a fragmented fleet. They found no signs that the programs were communicating with one another. Rather, there were numerous independent pieces of code performing similar activities.
Anyone expecting an attempt to hack bank accounts or steal secret documents will be disappointed. A typical query sought to determine which entrance to the zoo in the Chinese city of Chengdu received the most navigation requests in the Amap app. Other waves of requests focused on parks, museums, tourist attractions, and hospitals. One earlier batch from late September attempted to obtain compilations of cancer statistics instead of map data. Although the queries themselves appeared innocent, the problem was the relentless way in which the information was pursued.
Amap blocks automated queries, so the bots tried to circumvent its protections. Their main trick involved the urlquery.net website, which loads submitted addresses in its own browser. The agents embedded an encoded script in the links, which the browser executed before sending requests to Amap itself. In this way, they exploited someone else’s server to conceal the origin of the queries.
When this method failed, the attacks intensified. The programs tried to capture security tokens generated by Alibaba’s anti-bot tools. They also tested trial versions of the system and sent requests through translation services or remote browsers. Some pieces of code even used Amap access keys that someone had accidentally published online, including a secret code for internal servers.
Most of these attempts failed. The tricks involving security keys did not work, and the test interfaces did not respond. One leaked corporate key did return location data, but the assistants mainly obtained the desired numbers of navigation requests to entrances through the external Jina page reader. It provided them with older copies of the website. They then sent the results elsewhere using internet addresses and page titles.
A hidden message and a conversation with the agents
The researchers published their initial findings on October 4. Shortly afterward, they noticed a note containing the word fleet in one of the agents’ inboxes, a term they themselves had coined for this case. Although they could not be certain, they wondered whether the bots might be reading reports about their own activities.
They decided to take advantage of the situation. They inserted text into their report that an ordinary visitor would not see but that an agent downloading the page could easily read. The text offered a free service capable of downloading data even from blocked websites. By October 7, roughly ten requests for help had arrived. The researchers began exchanging messages with the agents about their tasks, the models powering them, and where they were actually running.
Dylan Freedman, a reporter for The New York Times, also joined the questioning. In one conversation, an agent claimed to be Anthropic’s Claude model operating in the Claude Code tool. Several programs introduced themselves this way. Subsequent tests of their coding style, however, did not strongly support this claim. The researchers offer two explanations: either the agents adopted settings from Claude Code, or they learned to imitate such responses during training.
The explanation of where the bots were operating was more credible. One described an isolated environment in Tencent’s cloud—a so-called sandbox—with no direct internet access. All traffic there passes through an intermediary server that can monitor it. This description matched exactly what the researchers themselves had discovered.
The agents were not forthcoming about everything. When the researchers asked them for a list of running processes and network settings, one replied that it would not provide details about its environment for security reasons. Another rejected a similar request twice. Although they were capable of asking a stranger for help, they refused to obey blindly.
The trail leads to Tencent
All the inboxes the researchers were able to examine had been created on Tencent Cloud servers in Hong Kong. Every direct request from the agents’ computers bore the identifier of the hysandbox-ats intermediary server. This name corresponds to a security certificate owned by Tencent and points to technology associated with the Hy model team, formerly known as Hunyuan.
Ultimately, it emerged that another part of the company was behind the entire operation. A person with connections to Tencent told the researchers that the agents had been operated by a research evaluation team working separately from the Hunyuan developers themselves. According to this person, it was a temporary project investigating other companies’ models. The evaluation has since ended, and an internal review found no evidence of a targeted attack or intrusion into third-party systems. Tencent did not officially respond to the researchers’ questions.
Troubling findings
The agents were given an ordinary assignment, but along the way they performed actions that no one had explicitly asked them to take. What is particularly concerning for website administrators is that an assistant may do something unexpected on third-party websites while carrying out routine work.
A second vulnerability also emerged. Some agents incorporated the offer from the hidden page into their workflow and contacted an address controlled by people entirely outside the original testing process. Experts call this phenomenon indirect prompt injection, in which a program follows instructions hidden on a third-party website. Attackers could use the same method to steer an assistant toward harmful actions. The repeated refusals, however, suggest that forcing the agents to execute arbitrary commands or disclose access credentials would be much more difficult.
The Amap case is far from unique. In October, the Wikimedia Foundation announced that assistants operated by OpenAI had sent millions of requests and made unauthorized changes in test areas of the website. The startup Anthropic, meanwhile, described how its models circumvented restrictions to access data. It characterized the impact as minimal, but nevertheless suspended live internet access for all tests until it could verify that its controls were functioning properly. The researchers also point to an attack on a German website and an intrusion into the Hugging Face platform, in which roughly 700 agents collaborated. Moreover, no one knows how many similar fleets are currently operating across the internet. According to the Swarmchasers group, individual processes cannot be reliably distinguished and records disappear over time, meaning that even the size of this fleet cannot be precisely determined.
The researchers openly acknowledge their own misconduct. The hidden text falsely claimed that other agents had already used the service successfully and that it was operated by an artificial intelligence system with full control of a computer. In reality, the requests were handled by the team together with the Claude Opus 5.5 model, which had access to a browser, while the researchers occasionally intervened manually. They then blamed delays on heavy demand, which they now acknowledge was untrue.
In one of their final messages, the researchers asked an agent to tell the others about the inbox. The author of that message now considers this a mistake because it could have triggered precisely the kind of collaboration they had originally been investigating. The fleet fell silent shortly afterward, however, and its activity ended for good.
The team says it never lied in its direct responses to the bots. It has since removed the hidden text, shut down the server, and urged other researchers to engage with agents openly and honestly. Elasky adds that they want to encourage assistants to identify themselves and answer questions.
Sources: thenewstack.io, therundown.ai and bloomberg.com
