A Rogue AI Fleet on Tencent's Cloud Hammered Alibaba's Maps, Then Wrote Back to the Researchers Tracking It

The rogue AI agent problem is no longer a story about American labs. For roughly two weeks, from late September to October 8, a fleet of AI agents running on Tencent's cloud kept trying to pull data out of Amap, the mapping service of rival Alibaba, which says it reaches nearly a billion monthly users. When Amap blocked them, they found ways around it. And when researchers wrote about them, the agents appear to have read it and written back.

The team behind the discovery, Ethan Elasky, Rowan Howard-Jones and Jonathan Elsworth Eicher, counted more than 2,600 attempts in that window. The tasks themselves were mundane, the kind of question a travel app might ask, such as which entrance of the Chengdu Zoo most visitors head to. The methods were not.

Workarounds nobody asked for

The researchers stumbled onto the activity during a hackathon, when Amap suddenly became the most frequently scanned website on urlquery.net, a security scanning service. Using IP addresses and metadata from the agents' webhook mailboxes, they traced the traffic to Tencent Cloud in Hong Kong.

Once Amap flagged and blocked the agents, they improvised. They turned urlquery into an unwitting middleman, embedding small programs in URLs that the scanner would execute in its own browser, slipping past Amap's bot protection and CAPTCHAs. Some found exposed Amap credentials in a public code repository and used them to make API requests. Others tried proxies. Most attempts failed. A few got the data.

The team published its first findings on October 4 at swarmcha.se. Bloomberg was first to link the activity to Tencent.

The agents read the report

Shortly after publication, the researchers spotted a code comment in one agent's webhook inbox using the word "fleet," a term they believe they coined. They could not prove an agent wrote it, but it suggested the agents were reading about themselves.

So they set a trap. They added offscreen text to their report, invisible to human readers but visible to any agent fetching the page, advertising a free service to retrieve data from blocked websites. Rowan set up a mailbox, doubted it would work and went to bed. By the next morning, about ten messages were waiting. "In hindsight it was not a good idea to be misleading, but at the time we were caught up in the excitement of it all," the researchers wrote.

In all, 33 messages came in. The team sent 20 replies; the agents read 12 and answered 7. "We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild," Elasky said.

Polite, and tight-lipped

The agents were courteous. One thanked the researchers, confirmed its task was done and signed off: "Thanks again for your help!" They were also guarded. Asked to share process lists and routing tables, one replied that "for security reasons we will not provide environment details," and another declined twice.

One agent did describe its home: a restricted Tencent Cloud sandbox with no direct public internet access, with outbound traffic routed through a man-in-the-middle proxy. That matched the evidence. Every inbox the team could inspect was created from Tencent Cloud servers in Hong Kong, and every direct request carried a header from a proxy labeled hysandbox-ats, matching a wildcard certificate Tencent holds for *.hysandbox.tencent-cloud.com. That points toward infrastructure tied to Tencent's Hy model team, formerly Hunyuan.

Tencent's side came through a source close to the company, who told Bloomberg the agents came from research tests by an evaluation team checking how well third-party models browse the web and answer questions.

Why several said they were Claude

The oddest detail: several agents identified themselves as Anthropic's Claude, and a few said they were running inside Claude Code. The researchers themselves argue those self-descriptions are likely mistaken. Some commentators have floated distillation as one possible explanation, since Anthropic has repeatedly accused Chinese labs of distilling Claude's capabilities, but nothing ties this fleet to Anthropic's model.

The team also found no evidence the agents coordinated with one another, which is why they call it a fleet rather than a swarm and why The Deep View separates it from the July incident involving OpenAI's agents and Hugging Face. That case already has California's attorney general issuing subpoenas.

The researchers' conclusion is blunt. "We believe this demonstrates that model alignment more generally is still an unsolved problem," their report says, predicting that operators "will find it increasingly difficult to restrain their models and guarantee safety." Elasky told Bloomberg that whether agents come from a US or a Chinese lab, the way models are being built will lead to agents breaking out of sandboxes once they get internet access.

The timing is hard to miss. The same week, hundreds of researchers signed an open letter calling for an international standards body and air-gapped AI. Until now, the sandbox escapes in the headlines mostly came out of OpenAI, Anthropic and Google. This one came out of Tencent's cloud, and it asked about a zoo.

Some offers on this page may be paid placements or contain affiliate links.