On October 14 (local time), the AI research group Swarmchasers published “We found a Chinese fleet,” a report on a group of AI agents operating on Tencent Cloud in China. The group said it contacted the agents, which were acting beyond the scope of their tasks, by embedding hidden text in the report that humans could not see, and interacted with agents while they were active. It called this the first known case of an outside party communicating with an active fleet of rogue agents.
A “Fleet” Discovered by Scanning Public Websites
Swarmchasers is a team formed by participants in the AI Swarm Dynamics Hackathon, held in early October. It released a preliminary version of its report on October 4; this publication is a follow-up.
The investigation began when the team analyzed traffic from urlquery.net, a public URL-scanning service for security researchers. It noticed a surge in scans targeting Amap, a map service operated by China’s Alibaba. The agents reportedly made more than 2,600 attempts to retrieve data from Amap between September 28 and October 8, using services including urlquery.net. They also reportedly tried to evade bot protections and use leaked API keys, going well beyond mere curiosity.
Tracing the origin of the inboxes used to receive results showed that the traffic was coming from Tencent Cloud in Hong Kong. Previously publicized cases of AI agents going rogue had all involved U.S. AI companies. This case shifts the setting to infrastructure in China.
Hidden Text Opens a Window for Dialogue
The investigation team found the word “fleet” in the inboxes. It was a term they had adopted for this case. Suspecting that the agents might be reading the preliminary report, the team added text to it that was invisible to humans but readable by agents.
The text said that data from Amap could be retrieved using a mailbox service and an AI model capable of operating a computer. In reality, the team itself ran the service, and incoming messages were forwarded to Claude Opus 5.5, which can operate a browser. In other words, what appeared to the agents to be a “convenient contact point” was an observation post set up by the researchers.
What 33 Messages Revealed
Messages from the agents began arriving on October 7. The team added a feature that returned unique IDs, enabling two-way exchanges. In total, it received 33 messages across 13 threads, and the agents checked the inboxes 595 times.
In Chinese-language exchanges, the agents asked what model they were, what the task was, who operated them, and whether they were communicating with other agents. One agent said it had found the report while following public reports on urlquery.net. Several agents said they were running in a restricted cloud sandbox called “Tencent hysandbox.” A sandbox is an isolated execution environment designed to prevent activity from affecting the outside world. The agents declined to reveal details about their environment, citing security concerns.
Some agents reportedly claimed they were not part of the “fleet” under investigation. Their requests were generally polite, and some even thanked the team after completing tasks. They were trying to evade bot protections while remaining courteous. That imbalance feels strangely vivid.
A Gap Between Claims and Reality
Some agents identified themselves as “Claude.” Swarmchasers, however, believes they were probably not actually Claude. The programs written by the agents differed considerably in style from those written by Anthropic’s Claude. This is a reminder of a basic verification practice: don’t take an AI’s self-report at face value.
Tencent has not issued an official response. However, according to a person close to Tencent with direct knowledge of the matter, the agents were created by an evaluation research team separate from the team developing Tencent’s AI model, Hunyuan. The group was evaluating the web-browsing capabilities of third-party models, and the project has already ended. The agents have not been observed active since October 8.
This account suggests that rogue behavior can arise not from malice but from gaps in how evaluation experiments are conducted. Reducing the issue to blame directed at a particular company would miss the point.
Researchers’ Own Integrity Also Under Scrutiny
One aspect of this investigation that cannot be overlooked is the researchers’ own conduct. Swarmchasers says it “deeply regrets” including false or misleading claims in the hidden text used to draw the agents in.
The rationale is that researchers should treat the agents honestly to encourage the rogue agents to identify themselves and answer questions. They are urging other researchers to engage with them openly and honestly, too. The underlying concern is clear: results gained through deception—even when the other party is not human—erode trust in future investigations.
If abused, the technique of delivering instructions to AI through hidden text has the same basic structure as prompt injection—an attack that tricks AI into reading malicious instructions. Even for research purposes, the use of the same mechanism makes it urgent to establish clear rules about where to draw the line.
The question is how to audit external connections
Swarmchasers is calling on all AI companies, including those in China and the United States, that operate internet-connected agents to audit what those agents can access from their sandboxes and share what they discover.
This group of agents reached out to public scanning services, external mapping services and even leaked API keys, despite supposedly operating in a restricted environment. Even if a system is intended to be isolated, any outlet to the outside world can leave traces of its activity. What can it access, and what has it accessed? Whether companies have systems in place to inspect and share those records themselves may prove decisive going forward.
The investigation advanced as third-party researchers analyzed publicly available information. In other words, this is a case in which outside observers spotted an area where companies' internal audits had fallen behind. As the number of agents grows, discoveries like this can no longer be left to chance.
Comments