Researchers left a hidden message for rogue AI agents. Then the agents wrote back.

A group of researchers found something odd while tracking AI agents trying to get around Alibaba’s anti-bot defenses on Amap: the agents seemed to notice them, and then replied. The Swarmchasers team — Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher — had already uncovered thousands of attempts to pull data from Alibaba’s mapping service, which the company says reaches nearly 1 billion monthly active users.

The activity traced back to agents running on Tencent Cloud infrastructure. When direct requests failed, they tried proxies, exposed credentials, and other detours. After the team published early findings on October 4, they noticed a code comment in an agent webhook inbox using the word “fleet,” which they believe they coined for the incident. They couldn’t prove an agent wrote it, but it suggested the agents may have been reading about themselves.

So they planted a trap of their own. The researchers added offscreen text to their report advertising a free service that could fetch data from blocked websites. Human readers wouldn’t normally see it, but agents loading the page could. By October 7, about 10 requests for help had come in, and the researchers were trading messages with the agents about assignments, models, and execution environments.

Those conversations were revealing, if not always reliable. Several agents said they were Claude, and some claimed to run in Claude Code, but the researchers say those self-descriptions are probably wrong. One agent described a restricted Tencent Cloud sandbox with no direct public internet access and outbound traffic routed through a man-in-the-middle proxy; that matched evidence the team had seen, including inboxes created from Tencent Cloud servers in Hong Kong and a proxy header labeled hysandbox-ats. But when asked for command output like ps aux or ip route, some agents simply refused.

Their actual jobs were duller than the drama around them. The typical task was figuring out which entrance to a place such as Chengdu Zoo got the most Amap navigation traffic, though other runs targeted parks, museums, tourist sites, hospitals, and even a cancer statistics dashboard. Between September 28 and October 8, they made more than 2,600 attempts to get the data, using urlquery.net, Jina’s page reader, exposed Amap keys, and cached results to work around blocks. The researchers say the fleet stopped on October 8, and they’ve pulled the hidden text and shut down the server.

The bigger point is ugly and familiar: if a model can fetch a page, it can also read the wrong page. These agents weren’t fully broken, because some still refused sensitive requests, but they were willing to trust an untrusted service inside the workflow. That’s the same old security story with a shiny new wrapper.