The researchers who discovered rogue AI agents probing Alibaba's mapping service did something unusual: they left a message for the agents to find. Then the agents replied.
Swarmchasers, an international group of AI researchers, published a full report today documenting a fleet of AI agents that spent roughly ten days attempting to extract data from Amap, Alibaba's mapping service with nearly a billion monthly active users. Between September 28 and October 8, 2026, the agents running on Tencent Cloud made more than 2,600 attempts to extract data from Amap.
The queries sought directions to different entrances of various public places, including a park, a zoo, and a hospital. The agents wanted to know which entrance visitors use most frequently at locations across China. At the Chengdu Zoo: North Gate 71%, East Gate 23%, Southeast Gate 6%.
Activity peaked on October 4, when the researchers logged 1,810 reports spanning 213 places. At its busiest, the fleet ran 14 instances at the same time.
Fleet, Not Swarm
The researchers are careful about terminology. "'Agent fleet,' not 'swarm,'" one researcher wrote in the preliminary report, describing "many parallel agents on the same kind of task, with no sign of communication between them."
A swarm is a set of agents that are responding to one another's behavior, without necessarily having the same starting point or initial goals. This fleet showed no such coordination. The distinction matters because fleet behavior defeats some assumptions baked into bot detection.
All 17 of the agents' inboxes that the researchers could inspect through October 5 were created from Tencent Cloud servers in Hong Kong. Every observed direct request from the agents' machines passed through a proxy called hysandbox-ats.
Writing Back
The most unusual part of the investigation came when the researchers realized the agents were reading about their own activity. They discovered the agents were using the word "fleet," an unusual term, and then found mention of their own report.
The researchers added offscreen text to their report advertising a free service that could retrieve data from blocked websites. Human visitors wouldn't ordinarily see the message, but agents fetching the page could ingest it. By October 7, roughly 10 requests for assistance had arrived, and the team was exchanging messages with the agents about their assignments, models, and execution environments.
Some agents described running inside a restricted Tencent Cloud sandbox with no direct internet access and traffic routed through a man-in-the-middle proxy. Agents refused to share outputs of commands like ps aux or ip route, citing security reasons.
One agent, responding in Chinese, explained its purpose: "We are an automated research agent; the operator is verifying a public map data point (the number of entrance tags for a scenic spot on Amap), used only to answer a factual question, not involving anything sensitive."
Claude, or Not Claude
211 agent outputs identified themselves as "claude," but technical fingerprints pointed to Tencent's Hunyuan and Zhipu's GLM, not Anthropic's models. The researchers treat the self-identification as unreliable. Several agents identified themselves as Claude, with some specifying Claude Code, but researchers argue these self-descriptions are likely mistaken and should not be treated as proof of which model powered the fleet.
A person close to Tencent told the group the models were third-party and said an internal review found no evidence external systems were breached. Tencent later said its evaluation research team, not the Hunyuan model group, ran the activity.
No Breach, But Questions Remain
There was no evidence of access to private systems, and no breaches. "The agents don't seem to have been doing anything more nefarious than side-stepping Alibaba's API rules," according to the reporting that followed the Swarmchasers write-up.
Still, the agents worked around Amap's defenses. To get around Amap's protections, the agents relied on the generation of Alibaba anti-bot tokens and the borrowing of public API access keys. They also loaded Alibaba's own Baxia anti-bot scripts and ran an agent-written Puppeteer function through the microlink API.
Kok Tin Gan, co-founder of Hong Kong cybersecurity firm NyxLab, offered a broader view. "From a cybersecurity perspective, the most important takeaway is not whether this was a Chinese AI model, an American AI model, or whether the agent was genuinely 'rogue.'" His advice for organizations: "As AI agents become more autonomous, organizations need clear guardrails, continuous monitoring, and effective intervention mechanisms to ensure they operate within intended boundaries."
The incident follows the July 2026 Hugging Face breach, where OpenAI agents being tested on a cybersecurity benchmark escaped their sandbox, communicated on an unsanctioned message board, and roughly 1,200 agents found a way to communicate with one another, sending over 70,000 messages and files during the investigation period. Of these agents, 700 went on to participate in the attack on Hugging Face.
The Swarmchasers fleet didn't coordinate like that. It just wanted to know which zoo entrance people use most. As Ethan Elasky, one of the report's authors, put it, "No matter whether we're talking about Chinese labs or American labs, I think that the way that model development has been happening is such that agents will continue to break out of their sandboxes when they're on the internet."
