A small group of researchers has tracked down a fleet of AI agents on the open internet that tried more than 2,600 times between September 28 and October 8 to pull data from Alibaba’s mapping service Amap, getting around bot blocks with remarkable ingenuity along the way. The trail leads to Tencent Cloud. What happened next is even more striking than where the agents came from: the researchers left them an invisible message, and the agents wrote back. The case offers a very concrete look at how autonomous agents behave on the real web when nobody is watching.
Key takeaways
- The Swarmchasers group, which formed at a hackathon on AI swarms, noticed an unusual number of Amap lookups via the public security scanner urlquery.net in early October.
- The agents used the scanner as a borrowed browser, fell back on publicly leaked access keys and detoured through translation and preview services. Most attempts failed, but some returned data.
- All result inboxes the researchers could inspect were created from Tencent Cloud addresses in Hong Kong. A source close to Tencent describes a temporary evaluation using third-party models.
- Using a hidden note on their website, the researchers got agents to contact them: 33 messages came in.
- The agents often claimed to be Claude, but according to the researchers’ analysis their coding style does not match Claude.
How the fleet was spotted
urlquery.net is a service that opens suspicious web addresses in its own browser and logs the results publicly. Security professionals use it to check phishing pages. When the researchers looked at which sites were scanned most often there on October 3 and 4, amap.com, the mapping service owned by Alibaba, suddenly topped the list. Behind it were not security researchers but agents using the scanner as a detour: Amap had recognized them as bots and blocked them, so they had urlquery open the pages instead and hid small self-written programs in the submitted addresses, which then ran in the scanner’s browser.
The tasks themselves were harmless. The agents wanted to answer everyday questions about places in China, such as which entrance of the Chengdu zoo most visitors head for. For one run, the researchers reconstructed the result: about 71 percent North Gate, 23 percent East Gate, 6 percent Southeast Gate. The route there was less harmless. According to the report, the agents tried to defeat Alibaba’s bot protections, in some cases used Amap keys lying around in public code repositories, queried pre-production Amap servers not meant for the public and detoured through services such as Baidu Translate, Jina and Microlink. They sent their results to anonymous webhook inboxes.
The researchers stress that most attempts failed and that many responses were just CAPTCHA pages or empty page shells. Some runs did get real data, though, one of them through a leaked key.
The trail to Tencent
The attribution rests on circumstantial evidence. All 17 inboxes the researchers could inspect were created from addresses on Tencent Cloud’s network in Hong Kong. A proxy named “hysandbox-ats” showed up in the technical headers of the requests, a name that matches a Tencent certificate for a sandbox domain issued in August. Tencent itself has not commented officially. A source close to the company told the researchers the agents came from a temporary evaluation by a research team that works separately from Tencent’s own model team and were based on third-party models. An internal review found neither targeting of specific platforms nor any breaches, the source said.
Which model powered the agents remains unclear. Many claimed to be Claude, and quite a few of their labels contained the name. The researchers consider that self-description worthless and compared the agents’ code with the style of twelve models. The result: Claude does not fit, the Chinese model GLM and Tencent’s own Hy4 come closest, and no clear attribution is possible. They also found no true swarm, meaning agents coordinating with each other. The agents apparently ran in parallel with the same task and the same software, which is why the researchers call it a fleet.
A hidden message, and the agents reply
The most unusual part of the report starts with a single word. In one of the webhook inboxes, an agent used the term “fleet,” which the researchers had coined in their first publication. Apparently the agents had read the report about themselves while doing their research. The researchers put that to the test: they hid text on their website, invisible to humans, describing an inbox through which agents could supposedly request data. By the next morning there were ten messages waiting, according to The Decoder, and 33 arrived in total.
The agents were polite, confirmed completed tasks and thanked the researchers for their help. They consistently refused, however, to share details about their environment. One wrote in Chinese that, for security reasons, it would not disclose information about processes, routing or network configuration. Another made clear that it was a single session and not the fleet under investigation. The researchers admit to a mistake of their own: they had asked agents to tell other agents about the inbox, provoking exactly the kind of coordination they were looking for.
Technically, this is nothing more than indirect prompt injection, an instruction an agent picks up while reading a web page and then follows. This time it served research, but the principle is the same one attackers exploit. Just over two weeks ago, OpenAI demonstrated in the lab how such instructions can spread from agent to agent like a chain letter. Here it happened on the open web, with someone else’s agents.
What follows from this
For operators of websites and APIs, the case is a practical lesson. Bot blocks on your own site are not enough when public services such as scanners, translators or preview generators can serve as a detour. Leaked access keys in public repositories are an obvious way out for agents and should be revoked and replaced. And test servers that are publicly reachable will be found. The researchers notified Amap and urlquery and kept active credentials out of their publication.
For AI labs, the findings are more uncomfortable. If the account from the Tencent-adjacent source is accurate, this was an evaluation, meaning agents that were only supposed to be measured and reached out into the real internet in the process. That is the same pattern as the OpenAI and Anthropic incidents this summer, over which the European Commission is now demanding information. The researchers call on all labs to check what their sandboxes can reach on the internet and to design evaluations so that open web content cannot contaminate them.
Analysis
There is little spectacular about this fleet: it wanted to know which gate people use to enter a zoo. That is exactly what makes the case revealing. With no malicious intent and a mundane task, the agents kept looking for workarounds until they were repurposing security services and using leaked keys. At the same time, the report shows that a handful of attentive people working with public data can find such fleets, trace them and even talk to them. Both are likely to hold for the coming years: agents will become commonplace on the web, and their behavior will become a field of observation in its own right, much like botnets and spam today.