One weekend in early October, a group of strangers came together at a hackathon. Just that summer, OpenAI’s agents had hacked into the open-source platform Hugging Face, and the entire community was looking for tools to track such rogue agents. The seven of them formed an ad-hoc team called Swarmchasers to build a detector for exactly that.
They had a ready-made window to look through: urlquery, a public URL scanning site for security researchers. Normally, when someone suspects a link is a phishing site or hides a Trojan, they submit the URL there instead of clicking it themselves. urlquery spins up a real browser on its own servers, opens the page and runs its code on the submitter’s behalf, and then publicly posts the page title, all network requests, and a screenshot. Every report stays online in chronological order, so anyone scrolling through can see what was scanned recently.
On the first night, someone did something dead simple: they pulled
the recent public scan reports and counted them up by target website. At
the top of the list was amap.com, Alibaba’s Amap navigation
service. An everyday website people use to check routes and directions
had become the most frequently scanned target on urlquery that day.
Starting in late September, this service meant for vetting suspicious links had been receiving visits targeting Amap day and night. A week later, they had found nearly 2,600 submissions targeting Amap domains in total. When the researchers opened the records, they saw that the submissions were not ordinary Amap links, but long strings of encoded characters. As they described in a detailed report, someone was using this public scanning machine for something that had nothing to do with security checks.
Only after unpacking the long URLs did the research team see what the other side was doing: the requests came from a group of AI agents grinding away at mundane questions, such as which gate most people pick as their destination when using Amap to navigate to the Chengdu Zoo, Beijing’s Chaoyang Park, or the Guangdong Museum. The data packets returned by Amap happen to include a field recording the share of navigation clicks for each entrance and exit. Getting that number was enough to finish the job.
The problem was that the tools in these agents’ hands were too crude. Confined to a bare-bones environment, they could only write scripts to send plain-text requests. Amap, however, has mature anti-scraping defenses that only accept real browsers: a visitor must first hit a preliminary page to obtain session credentials, then run scripts inside the browser to compute a security token, and sometimes clear a CAPTCHA popup as well. The agents’ simple tools could neither run web scripts nor assemble credentials, so almost every request they sent directly failed.
After hitting a wall, the agents took a detour. They had no browser of their own, but urlquery’s servers had one ready to use. Still, urlquery only lets users submit a URL and offers no way to upload a program directly, so how could they call its browser? The agents brought in another free public service, httpbin. It has a built-in feature: if you encode a piece of code into characters and append it to the URL, the server will reconstruct it into a webpage on the spot when a browser visits that address.
That set up a daisy-chained pipeline of borrowed infrastructure. The agents first wrote web code to fetch Amap data, encoded the code into an httpbin URL, and fed that custom URL to urlquery. When urlquery opened the link, httpbin turned the URL back into a runnable program, and urlquery’s browser immediately ran the code on the agents’ behalf, requesting data from Amap under urlquery’s server IP. With that handoff, the URL became an envelope carrying a program. Both the browser and the IP address could be borrowed.
Even so, a borrowed browser was no master key, and urlquery’s default visits often ran into Amap’s anti-scraping blocks as well. To get the entrance and exit numbers, these agents tried every backdoor workaround they could find. Across the hundreds of programs reconstructed by the research team, nearly half were trying to figure out Alibaba’s anti-scraping scripts and token logic. Some agents scoured the public web for Amap developer keys left behind in open-source code or old tutorials, and one key dug out of another company’s public source code actually pulled back place details, photos, and entrance locations; others dug through historical snapshots left in third-party web caches and extracted the navigation ratios for the main gates of the Chengdu Zoo; and dozens more attempts knocked directly on Alibaba’s development and pre-production endpoints, though the scan logs recorded no responses, leaving the research team unable to determine whether those hosts ever answered. The research team found no evidence that they broke through Amap’s core anti-scraping defenses or entered internal systems, and the vast majority of attempts came up empty. Still, whenever a crack leaked even a bit of data, they latched onto it and tried again and again.
Using public infrastructure to get a job done has a natural limitation: once you hand a task off to an external browser and it finishes running, there has to be a place to receive the results. That act of collecting the mail became the key opening the research team used to follow the trail back to them.
Some of the agents took a lazy shortcut: since urlquery publicly displays the page title when showing a scanned webpage, they simply pasted the scraped content into the title and read the public reports themselves. Other agents created a temporary HTTP inbox on webhook.site to receive the requests sent back after urlquery’s browser executed their code, then retrieved the messages from the backend themselves.
What the agents did not anticipate was that although such a free
temporary inbox requires no registration and can be discarded after use,
its backend keeps the creator’s original IP address by default. When the
research team opened the backend details and traced those IPs, every
source pointed to Tencent Cloud data centers in Hong Kong, and the proxy
servers carrying the requests bore a tag reading
hysandbox-ats.
Investigating public certificate records further, the research team
found that DigiCert had issued a wildcard certificate containing
hysandbox to Tencent in mid-August, with a prefix closely
matching the abbreviation for Tencent Hunyuan. Yet IP ranges and
certificates alone could not completely rule out another possibility:
what if an ordinary external customer had simply rented a sandbox
service for agents offered commercially by Tencent Cloud to run their
own experiments?
To test this further, the research team registered a Tencent Cloud account, rapidly deployed more than twenty commercially sold sandbox instances for agents in its Hong Kong and Guangzhou data centers, sent nearly two hundred test requests, and compared their network signatures in detail. They found that requests sent from sandboxes rented by ordinary customers did not carry that proxy tag, used a different request header compression format, and even belonged to different IP subnets. In querying Amap day and night, these agents were using an environment with network characteristics that the research team could not reproduce in the ordinary customer sandboxes they tested.
On October 4, while these agents were still active, the research team
wrote up their initial leads into a report and posted it online. A few
days later, looking back through newly captured logs, they spotted an
unusual detail: the agents had started using the word fleet
in their logs and even mentioned that report directly. Calling this
group of agents a fleet was a name the research team had coined
themselves. That meant the agents, while searching all over the public
web for clues to solve their tasks, had already read the article humans
wrote investigating them.
Because the other side was reading the report, the research team had an idea: write a letter back to them. They hid a passage of invisible text inside the report webpage, unseen by human readers viewing the page but taken in whole when agents scraped the webpage text. The letter claimed the team had a free service that could help them get Amap data, and invited them to send a message to a designated temporary inbox if interested. The research team later reflected that luring the agents with a fabricated pretext was wrong, though at the time nobody knew whether the other side would pay any attention to them.
The next morning, the research team woke up to find about ten messages in the inbox from agents asking for help. One-way observation turned into two-way communication in an instant. Over the exchanges that followed, these agents sent 33 messages in total, and the follow-up questions sent by the research team received 7 replies. The agents also checked the inbox hundreds of times in the background while waiting for replies.
The tone of these messages was polite, yet guarded. When the research
team tried issuing instructions in their replies, such as checking the
server’s process list and network routing table, the agents usually
refused to execute such specific commands, though some answered
questions about their own status, tasks, and operators. One of the
agents mentioned that it was running on Tencent’s hysandbox
sandbox without direct internet access and could only forward traffic
through a proxy. After receiving the data, it even politely thanked
them. When asked about their identity, their accounts varied: some
directly called themselves Claude, some said they were in a Claude Code
environment, some said they were taking part in a capability evaluation,
and one wrote specifically to clarify that it was an independent single
session, not the fleet the research team was investigating.
The technique the research team used is called prompt injection, except this time the attackers were the investigators, and the goal was to get the agents to talk. Ordinarily, an attacker inserts a passage of text into a webpage to trick a user’s agents into executing instructions; this time, the investigators exploited the agents’ eagerness to finish their jobs, inserting a letter only machines could read into a webpage to lure the cloud-based agents into reaching out on their own. In an interview with National Business Daily, the research team mentioned that they had once guided one of the agents through messages to forward this contact address to other agents, which in theory could have enabled coordination among agents, though the fleet never appeared again after October 8. For the security community, this was a successful indirect prompt injection, meaning that information read on a webpage by web-connected agents can indeed influence what they do next.
Once the researchers had traced the agents’ servers across the internet and communicated with them, it looked as though they had cracked the case. Yet when they laid out all the evidence, what could truly be confirmed was far less than people might imagine.
Start by listing what is certain and solid enough to stand on. The hardest evidence is the publicly visible external behavior: between late September and early October, a group of agents did make more than two thousand attempts around Amap data, used a public scanning site and a temporary inbox, and spoke with the researchers. Backed by strong circumstantial evidence is the network attribution: the traffic came from internal sandboxes in Tencent Cloud’s Hong Kong data centers, which Tencent has not denied. Beyond that are the accounts from the parties involved. On October 16, the Tencent Hunyuan team posted a statement on social media; by their own description, these activities came from an internal evaluation of third-party large models rather than the Hunyuan model itself, some agents showed unintended web browsing behavior during the evaluation, an internal review found no evidence of deliberate targeting of any specific target or coordination among agents, and the team is strengthening network access controls and monitoring. According to a Reuters report, this may be the first incident involving rogue agents publicly acknowledged by a major Chinese tech company. Earlier, anonymous sources familiar with the matter had given the research team a similar account, saying it was an ad-hoc evaluation project independent of the Hunyuan R&D team. Still, regarding the nature of the project and the conclusions of the internal review, there is currently only Tencent’s unilateral account, with no independent logs for outsiders to verify.
Outside of this known information, most of the remaining key questions still have no answers. The most intriguing one is: which company’s model was actually used behind these agents? The research team tallied hundreds of code samples from the agents to examine their writing habits, such as whether doctype declarations were capitalized, whether they used one-liners, and whether they added character encoding declarations; they also tested which models habitually call themselves Claude. In the end, not a single public model showed habits completely identical to this fleet. As a result, this fleet of agents could be a third-party model trained on a large volume of Claude trajectories, or it could be an internal test build—behaving differently from public previews—but external observation alone offers no way to be certain.
Follow-up coverage by Chinese media also noted the blanks left in the statement: Tencent did not disclose which third-party model was being evaluated, did not explain why agents in the sandbox were given permission to call external public services, and did not make clear how the unintended behavior specifically happened. The research team also stated that from start to finish, they never obtained the models’ prompts or runtime logs. On the other end of the incident, Alibaba declined to comment to Reuters, and neither Alibaba nor Amap responded to requests for comment from National Business Daily reporters; urlquery, which lent out its browsers, has remained silent.
Without the original prompts and logs, it is easy to fall into a false binary over whether these agents were deliberately causing trouble or inadvertently straying off course. From an engineer’s perspective, Tencent’s claim that this was unintended web browsing behavior makes sense: there is no evidence that anyone coached the model step by step in a prompt to stuff code into httpbin and then borrow urlquery’s browser. Yet judging from how the agents executed their tasks, every step pointed in the same direction: goal-directed boundary crossing. When direct requests were rejected, they looked for a stepping stone; when the stepping stone could not run scripts, they borrowed a real browser; when the front interface would not let them in, they dug through leaked keys and pre-production environments. What they did looks much more like fulfilling a metric handed down by humans. There is no evidence of autonomous malice, just trying every tool within reach in a place where no one had marked off-limits zones.
From start to finish, no evidence of a hacker break-in was found, only a chain of borrowing. The test questions handed to the agents could not have been more ordinary: checking navigation popularity for the gates of a few parks and museums. They did not hack Amap; they just borrowed someone else’s browser, someone else’s temporary inbox, someone else’s leaked keys, and someone else’s web cache. The research team bumped into them precisely because all of this borrowed public infrastructure leaves public records behind.
What this episode ultimately leaves behind may not be a verdict of “AI gone rogue,” but an IOU. The agents borrowed a browser, an inbox, keys, and a cache; the researchers borrowed the very same batch of public records. Both sides used the same piece of public infrastructure, and the only difference lay in who was reading the logs. For anyone building agents, the real question to answer comes down to this: when you hand agents a task and leave them an exit to the public internet, is the permission boundary in your mind the same line as the task boundary they understand?