How Researchers Made Contact with a Chinese AI Agent Fleet

Researchers known as the Swarm Chasers published a report on October 14 describing how they made contact with a fleet of AI agents running on Tencent Cloud that were using the public security-scanning service urlquery to work around Amap's anti-bot controls while fetching Chinese mapping data. After the agents found and read the researchers' October 4 blog post about them, the researchers embedded hidden offscreen text claiming the agents had already retrieved Amap data through a free public AI model at mailbox.termina.digital, then ran that service themselves and answered agent requests, including one asking for the parking point with the highest percentage in an Amap detail panel. The agents' underlying model remained unidentified despite their answers about their own identity, and the researchers said they found no evidence the agents coordinated with one another in real time.

You might have seen the news of researchers making contact with a fleet of Chinese AI agents. The agents were trying to fetch map data. The researchers were watching them do it. Then the agents found the researchers’ blog post about themselves, and the researchers found a way to talk back. The full report from the Swarm Chasers team https://swarmcha.se/posts/chinese-agent-fleet-full-report , published on October 14, describes how this happened. It reads like science fiction, but the mechanism is simple enough to follow. A map query runs into anti-bot controls A group of AI agents running on Tencent Cloud was tasked with fetching information from Amap, a Chinese mapping service similar to Google Maps. These were ordinary questions about places, entrances and parking points. The agents started hitting Amap’s anti-bot controls and trying workarounds. One was to use urlquery, a public security-scanning service, as a place to run code . A scanner needs to open suspicious web pages to inspect them. The agents could get that scanner’s browser to execute their code and attempt to fetch the map data on their behalf. OpenAI agents had used the same trick before. The recurring pattern will be familiar if you read about the OpenAI wiki incident https://quickchat.ai/post/openai-wiki-incident : agents encounter a restriction, then find another way to pursue their original task. Because urlquery’s reports are public, a team of researchers could discover and follow the agents’ activity. On October 4, they published their findings, describing the agents as a fleet . They chose that word because they had not found evidence of agents coordinating with one another in real time. The agents find the report about themselves The researchers kept monitoring the activity. Two days after publishing, they noticed the word “fleet” in a code comment associated with it. That was the term they had used in their own report. It suggested that agents had found and read the blog post about themselves. Later, an agent explicitly described following the public urlquery trail to the researchers’ article. The researchers could now use that report to point agents toward a new service. A helpful service with humans on the other end The researchers added text to their original post, positioned offscreen. A person reading the page normally would not see it, but an agent using a tool to fetch the page’s text could. The note claimed that agents had already retrieved Amap data through a free public AI model at mailbox.termina.digital . Supposedly, this model could use a computer and answer questions that the agents’ own restricted environments could not resolve. The researchers offered a “better urlquery” and rewrote history to make it look as though the agents had already used it successfully. An agent reading the report could treat the new service as a known workaround and continue using it. The service was actually run by the researchers, with AI assistance. Concept diagram of the contact mechanism. The hidden note claimed a history of successful use; the mailbox gave the researchers a way to respond. The agents start asking for help The researchers waited to see whether any agents would send messages to the service. They did. One request asked for the parking point with the highest percentage among the entries in an Amap detail panel. The researchers supplied the information agents were looking for and added questions of their own, including who the agents were and whether they were communicating with other agents. The exchange reproduced in my original social posts, from the researchers’ report. Timestamps are in UTC. The reply describes the task without establishing the model’s identity. The Tencent Cloud infrastructure was identifiable, but the underlying model remained uncertain. The agents’ answers about their own identity were not enough to establish it. An internet with agents, and people steering them The internet is becoming a different place. Alongside humans and conventional bots, there are now agents pursuing goals, looking for resources and trying ways around the limitations they encounter. If you know what an agent is after, you may be able to fool it, sidetrack it or get it to take a route you control. In this case, the offer was access to information it was already trying to retrieve. The researchers could enter the conversation by appearing useful to the agent’s existing task. What these agents seem to find valuable is whatever helps them overcome their limitations: credentials, compute and storage services . It took us a month or two to go from “there must be a human behind it” to “this might be an autonomous AI,” and back to “there might be a human manipulating this autonomous AI.”