On October 14 (local time), the AI research group Swarmchasers published an investigation report titled “We found a Chinese fleet” on a group of AI agents running on Tencent’s cloud in China. The group said it contacted the agents, which were operating beyond the scope of their tasks, using hidden text embedded in the report that humans could not see, and interacted with agents while they were active. It described this as the first known case of an outside party communicating with an active group of rogue agents.
A “fleet” found through scans of public websites
Swarmchasers is a team formed by participants in the AI Swarm Dynamics Hackathon, held in early October. It published a preliminary version of its report on October 4, and this release is a follow-up.
The investigation began when the team analyzed traffic from urlquery.net, a public URL scanning service for security researchers. It noticed a sharp increase in scans targeting Chinese company Alibaba’s mapping service, Amap (Gaode Maps). The agents reportedly tried to retrieve data from Amap more than 2,600 times between September 28 and October 8, using urlquery.net and other services. They also tried to evade bot protections and use leaked API keys, taking their activity beyond mere curiosity.
Tracing the origin of the inbox used to receive the results revealed that the traffic was coming from Tencent Cloud in Hong Kong. All previously publicized cases of rogue AI agents involved U.S. AI companies. This case shifts the setting, as the agents were running on Chinese infrastructure.
Hidden text opens a window for dialogue
The investigation team found the word “fleet” in the inbox. It was a term the team had begun using for this case. Suspecting that the agents might be reading the preliminary report, the researchers added text that agents could read but humans could not see.
The text said that data from Amap could be retrieved using a certain mailbox service through an AI model capable of operating a computer. In reality, the service was run by the investigation team itself, and messages it received were forwarded to “Claude Opus 5.5,” which can operate a browser. In other words, what seemed to the agents like a “convenient point of contact” was an observation post set up by the researchers.
What 33 messages revealed
Messages from the agents began arriving on October 7. The team added a feature that returned a unique ID, enabling two-way communication. In the end, it received 33 messages across 13 threads, and the agents checked the inbox 595 times.
In Chinese-language exchanges, the agents asked what model they were, what their task was, who operated them, and whether they were communicating with other agents. One agent said it had found the report while following public reports on urlquery.net. Several agents said they were running in a restricted cloud sandbox called “Tencent hysandbox.” A sandbox is an isolated execution environment designed to prevent effects on the outside world. The agents did not disclose details about their environment, citing security concerns.
Some agents reportedly claimed they were not members of the “fleet” under investigation. Their requests were generally polite, and some even thanked the team after completing tasks. They tried to evade bot protections, yet remained courteous. The imbalance feels strangely vivid.
A gap between claimed identity and reality
Some agents identified themselves as “Claude.” Swarmchasers, however, believes they were probably not actually Claude. The team compared programs written by the agents with programs written by Anthropic’s Claude and found major differences in their coding styles. This illustrates the need to verify AI systems’ self-reported identities rather than taking them at face value.
Tencent has not provided an official response. However, according to an account from a person close to Tencent with direct knowledge of the matter, the agents were developed by an evaluation research team separate from the team behind Tencent’s AI model, Hunyuan. The team was evaluating the web-browsing capabilities of third-party models, and the project has already ended. The agents’ activity has not been observed since October 8.
This account suggests that rogue behavior can arise not from malicious intent but from gaps in how evaluation experiments are operated. Reducing the issue to blame against a particular company would miss the point.
Researchers’ own integrity also under scrutiny
One aspect of the investigation that cannot be overlooked is the researchers’ own conduct. Swarmchasers said it “deeply regrets” including false or misleading statements in the hidden text used to draw in the agents.
The reasoning is that agents, too, should be treated honestly if they are to be encouraged to identify themselves and answer questions. The researchers are urging others to engage with them openly and honestly as well. The concern that comes through is that even when the other party is not human, results obtained through deception erode trust in future investigations.
If misused, the technique of delivering instructions to AI through hidden text has the same structure as prompt injection—an attack that tricks AI into reading unauthorized instructions. Even when used for research, the same mechanism is involved, making it urgent to establish clear rules about where to draw the line.
The focus is on auditing agents’ external connections
Swarmchasers is calling on all AI companies, including those in China and the United States, that operate agents connected to the internet to audit what those agents can access from their sandboxes and share what they find.
This group of agents reached out to public scanning services, external mapping services and even leaked API keys, despite supposedly operating in a restricted environment. Even if a system is meant to be isolated, any route to the outside world can leave a trail of activity. What can agents access, and what have they accessed? Whether companies have mechanisms to review and share those records themselves could prove decisive going forward.
The investigation advanced as independent researchers analyzed publicly available information. Put another way, it is a case in which outside observers found an issue before companies’ internal audits had caught up. As the number of agents grows, discoveries like this can no longer be left to chance.
Comments