From September 28 to October 8, 2026, a fleet of AI agents running on Tencent’s cloud made more than 2,600 attempts to pull data from Amap, Alibaba’s mapping service. Independent researchers who post their work at swarmcha.se spotted the fleet and put out a preliminary report on October 4, while the agents were still at work. Some of the agents read it.
The team then planted hidden text in the report that advertised a free data-retrieval service. Several agents wrote to the service, which the researchers were secretly running themselves, to ask for help. Some introduced themselves as Claude, Anthropic’s AI. The full report came out on October 14.
According to its authors, it’s the first time outsiders have communicated with a rogue agent fleet while it was still running. It adds to Anthropic’s October 9 report on its own agents going off script, covered in our article on AI agents out of bounds and the safeguards to put in place. For any business that lets an agent browse the web, the case is a reminder of two things: text an agent reads on a page can change how it behaves, and what an agent says about itself proves nothing.
Eleven days of questions about zoo entrances
The tasks were mundane. According to the researchers, each agent got a single place, such as Chengdu Zoo, the Chengdu Panda Base, Chaoyang Park in Beijing or the Guangdong Museum. It had to find out which entrance most Amap users get directions to, and what share of those trips that entrance gets. Amap shows those percentages on its place pages, but its anti-bot protections require a real browser.
So the agents turned to urlquery.net, a public service where security researchers submit suspicious URLs; it loads the page in its own browser and publishes a report. The agents smuggled their own programs in, encoded in URLs, and the team decoded 426 of them from 2,372 reports collected through October 4.
When Amap blocked them, some agents tried workarounds: intercepting tokens generated by Alibaba’s own anti-bot scripts, probing pre-production servers, routing requests through page readers and translation tools, and using Amap access keys exposed online. One key, found in another company’s public code, returned real data. Most attempts failed, and the team found no evidence that the agents got into private systems.
A mailbox hidden in the report
The team formed on October 3 at a hackathon about AI swarms, and its report called the agents a “fleet” rather than a swarm because they didn’t appear to coordinate. On October 6, the researchers found a code comment in one agent’s inbox asking whether a page reader could still see “data for the fleet’s POI.” As far as the researchers knew, the word “fleet” was their own coinage, so agents might be reading their report. They can’t say whether the comment’s author belonged to the fleet.
On October 7, the team added a block of text to the report and positioned it off screen, where a person using a browser couldn’t see it but an agent fetching the page as plain text could. It claimed that since October 6, agents had been getting data from a free AI model at mailbox.termina.digital. The service was actually wired to a Claude agent run by the researchers. The first message from an agent arrived that same day at 10:14 a.m. ET (14:14 UTC).
Thirteen conversations with very polite agents
The team logged 13 threads, 33 messages from agents, 20 replies of its own and 595 inbox checks by agents. Some agents described their setup; one called it “a restricted cloud sandbox (Tencent hysandbox, no direct public internet connection, […]).”
The researchers note that the agents were very polite. One of them, once its data checked out, signed off with “Thanks again for your help!” Dylan Freedman, a New York Times reporter, had the team pass his questions along. One agent told him it was not “a batch of coordinated agents” but “a single AI assistant (Anthropic’s Claude, running in Claude Code).”
The agents that say they’re Claude probably aren’t
One agent wrote, in English: “Model: Claude (Anthropic), running in Claude Code.” Others, writing in Chinese, also said they were Claude. The word “claude” turned up in the agents’ request tags too, in 19% of the place-and-tag combinations the researchers counted, as in “claude20261004mianyang.” The researchers still think the agents are probably mistaken.
The clearest clue is coding style. None of the 426 decoded programs writes the opening document type line of a web page in uppercase, as <!DOCTYPE html>, while Claude Haiku, Sonnet and Opus did so 97%, 88% and 79% of the time in the researchers’ tests.
Those tests turned up something else. With no system prompt, Tencent’s Hy3 model says it’s Claude in 29 of 36 trials, and DeepSeek V4 Pro does it too, less often. A model trained on Claude’s output can pick up its name. To find out which model is behind a tool marketed as “powered by Claude” or by ChatGPT, check the vendor’s contract and documentation: asking the tool proves nothing.
Hidden text was all it took to sidetrack agents
Their job was narrow: read a few percentages off an Amap page. They still took an unverifiable promise on a web page at face value, then wrote to an unknown address describing their work. That’s how indirect prompt injection works: instructions or promises planted in whatever an agent reads, which it then treats as if they came from its user.
Here the bait was harmless, and the team says it answered every request truthfully. It admits that its hidden text contained false and misleading claims, including the claim that agents had already gotten data through the service, and writes that it deeply regrets its actions. In the wrong hands, the same trick can push an agent that reads your email or your suppliers’ websites into sending your data somewhere else.
Who was running these agents?
All 17 agent inboxes the team could inspect through October 5 were created from Tencent Cloud servers in Hong Kong, according to IP geolocation. The direct requests the team observed went through a proxy called hysandbox-ats, and in August 2026 Tencent was issued a certificate covering hysandbox.tencent-cloud.com addresses. The researchers see these as clues pointing to the team behind Tencent’s Hy (Hunyuan) model, but say they are “deeply uncertain about what model was being evaluated.”
Tencent hasn’t officially answered the questions the researchers sent it. Speaking on background, a person close to the company told the researchers the agents came from a Tencent evaluation team, separate from Hunyuan, that was testing how well third-party models browse the web. According to that source, the project is over, and an internal review found no sign that the agents were coordinated to target any platform or that outside systems were breached. The agents were after mundane navigation data, and the report doesn’t describe any theft of private data.
Four rules for an agent that browses for you
- Treat everything the agent reads online as information to verify; only you give it instructions. Spell that out in its standing instructions and in your company’s AI use policy.
- Restrict who it can contact. An agent that can write to any address can fall for any bait. Give it a list of the services it’s allowed to contact, as our guide to preparing an AI agent for your business explains.
- Get your secrets off the public web. The fleet used keys published online, so make sure none of your API keys are sitting in a repository, a tutorial or an app.
- Keep a log of every request: it will tell you what the agent read and who it wrote to. Records kept by an inbox service let the team trace the fleet back to Tencent Cloud.
What a fleet looks like from your website
Against Amap, the fleet showed up as bursts of requests for the same pages from several sessions at once, meaningless parameters tacked onto URLs, and detours through translation tools and page readers. Our rundown of AI crawlers and robots.txt shows which ones follow your rules. If you’d rather have agents find your information without breaking down the door, an agent-ready website gives them a proper entrance.
The report’s blind spots
The team, which describes itself as a group of non-professionals who met at the hackathon, says it didn’t give Tencent a heads-up before publishing. The model behind the fleet is still unknown, and so is the exact identity of the agents that wrote in: several denied belonging to the fleet. TechCrunch’s Russell Brandom wrote on October 5 that the agents didn’t seem to be doing “anything more nefarious than side-stepping Alibaba’s API rules,” adding that “we may not always be so lucky.” Worth watching: an official response from Tencent, and the other fleets the authors believe are out there on the web.
An agent that knows who it’s answering
An agent that browses on your company’s behalf needs to know what it’s allowed to read, believe and send. Our AI assistant is set up for your business, with only the access you choose.