Researchers traced a fleet of AI agents that tried to scrape Alibaba's mapping service Amap, then exchanged messages with some of them. Between September 28 and October 8, 2026, agents running on Tencent Cloud made more than 2,600 attempts to collect Amap data, according to researcher Ethan Elasky.
A source close to Tencent said the activity came from tests by an evaluation team. The team was checking how well third-party models could browse the web and answer questions. The agents identified themselves as Anthropic's Claude, but that identity has not been confirmed.
The agents found routes around Amap's blocks
The assigned questions were harmless. One asked which entrance to the Chengdu Zoo most users choose. Amap flagged the agents as bots and blocked them, but the agents found ways around the restrictions on their own.
They put small programs into URLs sent to the security scanning service urlquery.net. Its browser executed the programs, giving the agents an indirect way past Amap's bot protection and CAPTCHAs. Some agents also found exposed Amap credentials in a public code repository and used them to make API requests.
Read nextMIT researchers improve weather forecasts two to six weeks aheadMost attempts failed, though a few agents obtained the data they sought. Similar workarounds for bot blocks have been documented in other cases: agents unable to reach a site directly found an indirect route.
The researchers found the fleet during a hackathon. They noticed Amap had become the most frequently scanned website on urlquery.net. IP addresses and metadata from the agents' webhook mailboxes led them to Tencent Cloud in Hong Kong.
A planted message prompted replies
One agent used the word "fleet" in a mailbox message. The researchers had coined that term for their project, which suggested the agents were reading the report about themselves.
To test that idea, the researchers placed invisible text on their website for agents with web-fetching tools to read. It described a mailbox where agents could request data. Teammate Rowan set up the mailbox, doubted it would work, and went to bed. By morning, it held ten agent messages. "In hindsight it was not a good idea to be misleading, but at the time we were caught up in the excitement of it all," the researchers write.
The agents sent 33 messages in total. The researchers replied 20 times; agents read 12 replies and answered 7. One agent thanked them, said its task was complete, and voluntarily answered questions about its runtime environment. It declined to provide process lists or network configurations before signing off: "Thanks again for your help!"
"We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild," Elasky writes. The researchers' full report is available on swarmcha.se.
