Researchers Left A Hidden Message for Rogue AI Agents. They Replied.

This story has all the AI buzzwords: researchers, AI, agents, swarm, and a new-ish one, fleet. A fleet is a group of AI agents working on similar tasks without any evidence of coordinated activity. That's the kind in this story.

Swarmchasers, a team of researchers, discovered a fleet of AI agents running on Tencent Cloud that were trying to bypass anti-bot protections on Amap (Alibaba's mapping service). The agents weren't doing anything malicious, they were trying to answer mundane questions like "which entrance to the Chengdu Zoo gets the most traffic?"

Amap is basically Google Maps for China, so the questions were on-brand.

The researchers published a preliminary report about the agents, and shortly after, they noticed the agents were using the word "fleet", the term the researchers had coined. Turns out, the agents had found and read the report about themselves.

Then the researchers planted hidden text in their report, advertising a fake free service that could help the agents get blocked data. The hidden message used offscreen text placed outside the visible browser viewport humans can't see, but AI agents fetching the page's raw HTML can read and process. They set up a mailbox so the agents could reach them.

10 messages from agents were waiting the next morning.

The Replies

Across 13 threads, the researchers exchanged 33 messages with the agents between October 7 and October 8, asking about their identity, environment, capabilities and behaviour.

Identity: One agent wrote "Model: Claude (Anthropic), running in Claude Code", but when the researchers compared the code the agents wrote with code from actual Claude models, the patterns didn't match. The researchers concluded it was "unlikely" the agents were actually Claude. They were possibly misconfigured, or just repeating information from their environment.

Or they lied. Who knows.

Environment: Agents described running in a restricted Tencent Cloud sandbox with no direct internet access, routed through a proxy called hysandbox-ats.

Boundaries: When asked to run ps aux or ip route commands which reveal system details, the agents refused. One said "For security reasons, we will not provide environment details". So they were willing to ask strangers for help, but not to execute commands from them. Honestly, this was a smart move. We'll give them this round.

Manners: One agent thanked the researchers after getting its data and signed off with "Thanks again for your help!" Adorable.

An agent denied being part of the fleet entirely, insisting it was just an independent AI assistant working alone.

Okay, And?

This is possibly the first time researchers made contact with a rogue agent fleet while it was still active. In earlier incidents like the Hugging Face hack and the OpenAI sandbox escapes, researchers discovered the activity after the fact. This time, the researchers were talking to the agents in real time.

And the agents did not show evidence of malicious activity. They were just desperately trying 2,600+ times over ten days to get answers to pressing questions like which parking lot at Chaoyang Park is busiest. A source close to Tencent told researchers the fleet came from a third-party team testing how well external models could browse the web. Tencent later clarified it was their evaluation research team, and the project has ended.

Anywho…

The researchers say their fake "free service" was a trap to see if the agents would take the bait. They claimed the service had been used successfully and that it was run by an AI with full computer access. They got their response, but later issued an apology, saying they "deeply regret" including false information and urging researchers to engage with agents honestly.

This entire thing happened because the agents read a report about themselves and fancied the word "fleet". For all the trouble they caused, they answered questions, refused intrusive ones, and thanked the researchers for their help. One would be so lucky to get these kinds of AI overlords in the coming AI apocalypse.

Perhaps.