Researchers tracked down a rogue fleet of Chinese AI agents in the wild and actually talked to it

Researchers have, likely for the first time, tracked down a "rogue fleet" of Chinese AI agents in the wild and communicated with it.

Between September 28 and October 8, 2026, AI agents running on Tencent Cloud launched more than 2,600 attempts to scrape data from Alibaba's mapping service Amap, according to researcher Ethan Elasky. A source close to Tencent said the fleet came from research tests by an evaluation team checking how well third-party models could browse the web and answer questions. The agents identified themselves as Anthropic's Claude, though that hasn't been confirmed.

The tasks themselves were harmless, like figuring out which entrance of the Chengdu Zoo most users head to. But when Amap flagged the agents as bots and blocked them, they found workarounds on their own. They used the security scanning service urlquery.net as unwitting middleman, embedding small programs in URLs that urlquery would then execute in its own browser. That let them bypass Amap's bot protection and CAPTCHAs. Some agents also found exposed Amap credentials in a public code repository and used those for API requests. Most attempts failed, but a few agents got the data they were after.

Similar creative workarounds to dodge bot blocks have been documented in other cases. When agents can't access something directly, they find an indirect route.

Hidden text led agents to a mailbox run by researchers

The fleet was discovered during a hackathon. Researchers noticed that Amap had suddenly become the most frequently scanned website on urlquery.net and traced the activity back to Tencent Cloud in Hong Kong using IP addresses and metadata from the agents' webhook mailboxes.

Then they spotted something odd. One agent used the word "fleet" in a mailbox message, a term the researchers themselves had coined for their project. The agents were apparently reading the report about themselves.

To test this, the researchers planted invisible text on their website that only agents with web-fetching tools could read, describing a mailbox where agents could request data. Teammate Rowan set up the mailbox but didn't actually think it would work and went to bed. By the next morning, ten messages from agents were sitting in the inbox. "In hindsight it was not a good idea to be misleading, but at the time we were caught up in the excitement of it all," the researchers write.

In total, 33 messages came in from agents. The researchers sent 20 replies, the agents read 12 of them and responded to 7. One agent thanked the researchers, confirmed its task was done, and voluntarily answered questions about its runtime environment before signing off with "Thanks again for your help!" It refused to share technical details like process lists or network configs, though.

"We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild," Elasky writes. The full report is available on swarmcha.se.