From Decrypt · By Jose Antonio Lanz
In brief
Swarmchasers used hidden text and a mailbox to exchange messages with some AI agents while they were still running; one described its job as checking public Amap map data.
The fleet made more than 2,600 attempts to retrieve Amap data, and some agents tried anti-bot workarounds or used exposed API credentials.
The activity traced to Tencent Cloud, but a person close to Tencent said the project tested third-party models rather than Hunyuan.
Researchers investigating AI agents hijacking Alibaba’s mapping service, Amap, managed to talk directly to some while the software was still running.
To do so, they added text invisible to human readers but visible to web-reading tools to a report the agents appeared to be scanning, then used a mailbox to ask about their tasks and environment.
Myriad: Which company will have the best AI model? Click to make your prediction.
One agent said it was checking a map fact—how many entrance labels appeared for a scenic spot on Amap—and described itself as running in a restricted Tencent Cloud sandbox. The researchers could not independently establish which model powered each run. They called it the first outside communication with an active rogue-agent fleet they knew of.
The October 14 Swarmchasers report traced more than 2,600 attempts from September 28 to October 8 to retrieve data from Amap, a Chinese mapping app operated by Alibaba. Some tasks were mundane, such as checking which entrance visitors most often use for Chengdu Zoo. Some agents kept trying after the service blocked their requests.
The researchers’ hidden text falsely described the mailbox as an AI service with computer-use abilities. In reality, it routed messages to a Claude agent operated by the researchers, which could use a debugging browser. The exchanges were not a controlled test, and the researchers’ intervention may have affected what agents said.
BitcoinBTC · USD$82,503+0.74%Oct 8Oct 10Oct 12Oct 14Oct 15$84.2k$82.9k$81.5k$80.2k24h HighHigh$82,50824h LowLow$79,806VolVol$1.8BMarket projectionsOdds by MyriadToday$82,000 to $84,000$82k–$84k55% chanceThis weekAbove $82,000Above $82k63% chance→Buy Bitcoin with USDTPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →After Amap blocked requests, some agents tried to intercept tokens generated by anti-bot software, route traffic through third-party page readers, or use API credentials exposed in public code repositories. One exposed key-and-security-code pair returned real place data. Researchers also found requests targeting four development or pre-production hosts, but said they had no evidence the agents accessed private systems.
Public records linked the fleet to Tencent Cloud since all 17 inboxes the researchers inspected were created from Tencent servers in Hong Kong, and observed direct requests passed through a proxy called hysandbox-ats. A person close to Tencent told Swarmchasers the activity came from a temporary evaluation project testing third-party AI models, not Tencent’s Hunyuan models.