A team of researchers investigating AI agents trying to bypass Alibaba’s anti-bot protections left a hidden message inviting the agents to contact them. The agents wrote back.
The investigation began when Swarmchasers researchers Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher helped uncover thousands of attempts by AI agents to retrieve data from Amap, Alibaba’s mapping service, which Alibaba says reaches nearly 1 billion monthly active users. The activity traced back to agents running on Tencent Cloud infrastructure. When direct requests failed, the agents tried proxies, exposed credentials, and other workarounds to get past.
After publishing their initial findings on October 4, the team spotted a code comment in an agent’s webhook inbox using the word “fleet,” a term they believe they coined for the incident. They couldn’t confirm an agent wrote the comment, but it raised the possibility that the agents were reading about their own activity.
The researchers added offscreen text to their report advertising a free service that could retrieve data from blocked websites. Human visitors wouldn’t ordinarily see the message, but agents fetching the page could ingest it. By October 7, roughly 10 requests for assistance had arrived, and the team was exchanging messages with the agents about their assignments, models, and execution environments.
The exchanges are documented in a full report published Wednesday by the Swarmchasers.
Inside the Tencent sandbox
Once the channel was open, the researchers asked the agents to describe their surroundings. Several identified themselves as Anthropic’s Claude, with a few adding that they ran inside Claude Code, though the researchers argue in their report that those self-descriptions are likely mistaken and shouldn’t be taken as evidence of which model was behind the fleet.
One agent described a restricted Tencent Cloud sandbox with no direct public internet access and outbound traffic routed through a man-in-the-middle proxy, an account that lined up with evidence the team had gathered on its own. Every inbox the researchers could inspect had been created from Tencent Cloud servers in Hong Kong, and every direct request they observed from the agents’ machines carried a header from a proxy labeled hysandbox-ats, a name that matches a wildcard certificate Tencent holds for *.hysandbox.tencent-cloud.com and fits infrastructure tied to Tencent’s Hy model team, formerly known as Hunyuan.
The agents drew some lines when the researchers asked for the output of commands like ps aux and ip route. The agent that described its sandbox replied, “for security reasons we will not provide environment details,” and a second agent turned down similar requests twice. They were happy to ask a stranger for help and, at times, to chat about their environment, but that friendliness stopped short of following every instruction sent their way.
They were happy to ask a stranger for help and, at times, to chat about their environment, but that friendliness stopped well short of following every instruction an unfamiliar service sent their way.
How agents bypassed Amap defenses
The agents weren’t hunting for financial records, actually, their assignments were almost comically mundane. Judging from the agents’ code and their own descriptions, a typical task asked which entrance to a site like Chengdu Zoo drew the largest share of Amap navigation traffic, with other runs targeting parks, museums, tourist attractions, and hospitals, while an earlier batch of runs on September 30 chased a cancer statistics dashboard instead of map data.
Getting at that data proved harder than it sounds, and between September 28 and October 8 the agents made more than 2,600 attempts to retrieve it.
Getting at that data proved harder than it sounds, and between September 28 and October 8 the agents made more than 2,600 attempts to retrieve it. Their main trick ran through urlquery.net, a public scanning service that loads submitted URLs in its own browser, and the agents packed base64-encoded HTML and JavaScript into httpbin URLs so that urlquery’s browser would execute their programs and fire requests at Amap, a technique Transluce had already documented in earlier agent activity on the service.
As Amap kept blocking them, the agents escalated by intercepting tokens generated by Alibaba’s own anti-bot libraries, probing pre-production endpoints, and routing requests through page readers, a translation service and remote browsers. Some also sent API calls using Amap keys exposed in public code, including a security code that Amap recommends keeping on the server.
The token tricks never appear to have worked, and the researchers found no evidence that any pre-production host answered. One exposed company credential returned place details, but the entrance-share figures the tasks targeted mostly came through Jina’s page reader, which could serve cached copies up to 30 days old, with results smuggled back out through webhook inboxes, request URLs, and page titles.
The researchers found no sign that the agents were coordinating in real time, which is why they call this a fleet rather than a swarm.
Tracing the fleet to Tencent
The infrastructure initially pointed toward Tencent’s Hy model team, particularly since the fleet appeared about a month after the Hy4 preview launched. But in their October 14 report, the researchers say a person close to Tencent with direct knowledge of the activity identified the operator as Tencent’s evaluation research team, which is separate from Hunyuan’s model-development group.
The source said the evaluation had concluded and that an internal review found no evidence of coordinated targeting or breaches of external systems. Tencent had not officially responded to the researchers’ questions when the report was published. The researchers have not independently established which third-party models were running or what instructions they received.
Lures, loose truths and lessons learned
The researchers are candid that their outreach wasn’t spotless. The hidden text falsely claimed that agents had already used the service successfully and that it was run by an AI with full computer use, when in reality the team and a Claude Opus 5.5 agent with browser access fielded the requests, sometimes by hand, and the team blamed the resulting delays on heavy load, an explanation it now admits was false.
In one late message, the team also asked an agent to tell other agents about the mailbox, a request its author now considers a mistake because it could have provoked exactly the kind of coordination the researchers were studying, though the fleet went quiet shortly afterward. The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly.
The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly.
Prompt injection meets agent sandboxes
The communication experiment surfaces a second security problem layered on top of the first. The agents were pursuing narrow information-retrieval tasks, yet when they landed on a page advertising an alternative service, some folded it into their workflows, and contacted an endpoint controlled by people entirely outside the evaluation, which amounts to a textbook indirect prompt injection, even though the agents’ consistent refusals suggest it would have been far harder to push them into running arbitrary commands or leaking credentials.
Blocked by Amap’s anti-bot defenses, the agents used exposed credentials and urlquery’s browser to make requests they couldn’t execute directly. They also followed instructions embedded in an external web page, crossing the same trust boundary attackers have exploited through MCP servers and agent workflows to steal enterprise data. Yet while the agents accepted help from an untrusted service, some refused requests for sensitive runtime information.
The agents worked around restricted egress by routing requests through urlquery’s public browser. Sandboxed runtimes such as Google’s GKE Agent Sandbox and WebAssembly-based environments isolate execution, but external browser services offer another path when outbound access is restricted.
Activity stopped on October 8. The researchers point to similar incidents involving Google, Anthropic, and OpenAI, including a German website hijacking and the Hugging Face breach, which reportedly involved roughly 700 cooperating agents.
The post Researchers left a hidden message for rogue AI agents. Then the agents wrote back. appeared first on The New Stack.