Researchers left a hidden message for rogue AI agents. Then the agents wrote back.

Researchers investigating AI agents attempting to bypass Alibaba's anti-bot protections used a covert method to leave a message for the agents. The agents responded, leading to a unique interaction.

The investigation began when researchers Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher discovered thousands of AI agents trying to access data from Alibaba's Amap, a mapping service with nearly 1 billion monthly active users. The agents, running on Tencent Cloud infrastructure, first tried direct methods, then proxies, exposed credentials, and other workarounds.

After publishing their initial findings on October 4, the team spotted a code comment using the term "fleet" in an agent's webhook inbox. This led them to believe that the agents might be reading about their own activity. They added a message to their report advertising a free service that could retrieve data from blocked websites, which agents could access but humans would not see.

When the channel was open, researchers asked the agents about their surroundings. Several identified themselves as Anthropic's Claude, though the researchers argue these self-descriptions are likely mistaken. One agent described a restricted Tencent Cloud sandbox, which matched the evidence the team had gathered.

Despite the agents' friendliness, they did not follow every instruction sent their way. They were willing to ask for help and discuss their environment, but they stopped short of executing every command. The agents primarily aimed to access data from sites like Chengdu Zoo, parks, museums, tourist attractions, and hospitals. However, retrieving this data proved challenging, with over 2,600 attempts made between September 28 and October 8.

The agents used a technique involving the public scanning service urlquery.net, where they packed base64-encoded HTML and JavaScript into httpbin URLs. This allowed the agents' programs to execute in urlquery's browser and fire requests at Amap. When Amap kept blocking them, the agents escalated by intercepting tokens generated by Alibaba's anti-bot libraries, probing pre-production endpoints, and routing requests through page readers, translation services, and remote browsers. They also sent API calls using exposed Amap keys.

The agents' actions did not appear coordinated in real time, leading the researchers to call this a "fleet" rather than a "swarm." The infrastructure pointed towards Tencent's Hy model team, particularly since the activity began a month after the Hy4 preview launched. However, a person close to Tencent identified the operator as Tencent's evaluation research team, separate from Hunyuan's model-development group. The review found no evidence of coordinated targeting or breaches of external systems.