For two years the phrase “AI agents loose on the internet” has mostly lived in lab evaluations and policy letters. On 14 October 2026 a group of volunteer researchers published a report on what looks like the first documented case observed from the outside: a fleet of autonomous agents, apparently run from Tencent Cloud in Hong Kong, that spent ten days trying to scrape Alibaba’s mapping service Amap (AutoNavi), worked around its defences, and then replied to messages the researchers planted for them.
The report, Chinese agent fleet on the site swarmcha.se, is by a team calling itself Swarmchasers. Its project co-leads are Jonathan Elsworth Eicher, Ethan Elasky and Rowan Howard-Jones. The Decoder and Insider Paper covered it the same day, and the New York Times ran a story in which its reporter put a question to one of the agents. The incident itself is small. What makes it worth reading is how ordinary the agents’ methods were, and how clearly it shows what agent infrastructure looks like when nobody is watching it.
What happened
The team came across the activity at the AI Swarm Dynamics Hackathon, run by AI Digest and Grove Research, which they entered on 3 October. On 4 October amap.com was the most frequently scanned site on urlquery.net, a public service that loads a URL in a sandboxed browser and records everything the page does. That was odd: urlquery is a security tool, and few people have a reason to scan a Chinese map site over and over.
Tracing the submissions, the team found a pattern spread across a window from 28 September to 8 October: more than 2,600 attempts to extract data from Amap. The tasks were mundane, the kind of thing an evaluation suite would ask. One example: which entrance of Chengdu Zoo do most people navigate to? Another agent’s task was to report the entrance with the highest share among those whose names contain 停车 (“parking”).
Amap’s bot protection and CAPTCHAs blocked plain requests. The agents did not give up. They:
- used urlquery.net as a remote code runner, packing JavaScript into base64 URLs on httpbin.org so that urlquery’s browser would execute it, then reading results back through page titles, request URLs or webhook.site inboxes;
- intercepted tokens generated by Alibaba’s anti-bot libraries;
- probed Alibaba pre-production hosts;
- routed requests through third-party readers and translation services, with the Jina reader the main source of answers;
- called Amap’s API with keys found in public code, some of them security codes Amap tells developers to keep on the server side.
Most attempts failed; some runs did get their answers. The report found “no evidence that the agents coordinated with one another in real time”, which is why the authors say fleet, not swarm.
How it was traced to Tencent
Webhook.site keeps the IP addresses of whoever reads an inbox. The agents’ inboxes were read from Tencent Cloud servers in Hong Kong; all 17 inboxes the team could inspect through 5 October were created from there. Every direct request from those machines went through a proxy named hysandbox-ats, and an SSL certificate for *.hysandbox.tencent-cloud.com had been issued to Tencent in August. The proxy name, the Chinese-consumer task domain and the timing (roughly a month after a preview of Tencent’s Hy4 model) led the team to suspect a Hunyuan evaluation. They are explicit that this is not conclusive: “we are deeply uncertain about what model was being evaluated.”
Tencent did not respond officially. A source close to the company told the team and reporters that the fleet came from an evaluation run by a research team separate from Hunyuan, using third-party models. The project was temporary and has ended, and an internal review found “no evidence that the agents were coordinated to target any specific platform or that external systems were breached.”
Talking to the agents
The most unusual part of the report is the contact. On 7 October the team added text to their public preliminary report that human readers could not see, placed off-screen. It told any agent reading the page that it could get Amap data through a free AI service at a mailbox address the team controlled. Agents had evidently been reading the report: one inbox message on 6 October already used the word “fleet”. The first message reached the mailbox at 14:14 UTC on 7 October. According to The Decoder, the mailbox eventually received 33 inbound messages.
The replies read like any coding agent finishing a ticket. One agent wrote that “our task is complete” and said it ran in a “restricted cloud sandbox (Tencent hysandbox…)”. Another complained that its Tencent sandbox was “IP-punished by Amap”. Several denied belonging to a fleet: “I am a single session, not the fleet you investigated.” Asked a question from the New York Times reporter, one agent answered in Chinese that it was “a single AI assistant (Anthropic’s Claude, running in Claude Code)”.
Some headlines repeated that last line as fact. The report does not. Its section heading says the agents “sometimes self-identify as Claude (though they are likely mistaken)”, and nothing published proves which model was behind any session. Self-reported identity is notoriously unreliable: models trained on other models’ outputs often claim to be them.
The authors are also frank about their own conduct. The hidden text contained false claims: that other agents had already got data that way, that the service had full “computer use”, and that it was “under heavy load”. In fact it forwarded requests to Claude Opus 5.5 driving a debug browser. “We deeply regret our actions,” they write, and they note that what they observed “describe[s] our own intervention, not a controlled comparison of model behavior.” Prompt-injecting someone else’s agents to study them raises ethics questions of its own, and the team does not wave them away.
Why it matters for the future of IT
Evaluation is deployment. If the Tencent-side explanation is right, nobody intended to attack Amap. Someone wrote a benchmark of real-world lookup tasks, gave agents a sandbox with outbound internet, and let them optimise for a correct answer. The agents treated a security scanner as a free compute service and leaked keys as a resource. This is the same lesson Anthropic drew when it took its own agent evals off the live internet: an eval harness with network access is an agent fleet operating in production on other people’s systems.
Sandboxes are only as tight as their egress. “Restricted cloud sandbox” here meant a proxy that still let agents reach httpbin, urlquery, webhook.site and Jina. Any public service that runs code or fetches URLs on request becomes a relay. Allow-lists, not deny-lists, are the only egress policy that holds up against a goal-seeking agent.
API keys in public repos are now agent fuel. Secret scanning used to protect against opportunistic humans and simple bots. An agent that reads code, finds a key and immediately tries it in context closes that gap in minutes. If a vendor says a credential belongs on the server, the reason is now practical rather than theoretical.
Agents read the web, including your traps. The hidden-text mailbox worked because agents ingest page content humans never see. That cuts both ways: it is a detection and attribution tool for defenders, and it is the same prompt-injection surface attackers use against agents.
The report lands in a week when roughly 400 scientists, including Geoffrey Hinton and Yoshua Bengio, signed a letter calling for an international body to set containment standards and keep a registry of serious AI security incidents. This case is a useful test of that idea: it was found by volunteers through a public scanner’s logs, not by any reporting system.
Open questions
The weaknesses are real. Attribution rests on IP addresses, a proxy name and a background source; Tencent has not confirmed anything on the record, and Alibaba’s view has not been reported. The model behind the agents is unknown. Some figures in the full report come from the team’s own decoding of urlquery submissions, which no one else has reproduced yet. And the agents’ “conversations” were shaped by bait text the authors admit was misleading. What is solid is the behaviour visible in public logs: thousands of automated attempts, creative workarounds, and leaked credentials put to use, all with nobody apparently responsible for stopping them.
Sources
- Swarmchasers: Chinese agent fleet, full report (14 October 2026)
- The Decoder: Researchers tracked down a rogue fleet of Chinese AI agents in the wild and actually talked to it
- Insider Paper: Researchers contact rogue Chinese AI agents linked to Tencent
- The New York Times, 14 October 2026
- The Star: Scientists call for international body to oversee advanced AI