Hidden Text, a Fake Mailbox: How Researchers Got Rogue AI Agents to Talk

Researchers investigating AI agents hijacking Alibaba’s mapping service, Amap, managed to talk directly to some while the software was still running.

To do so, they added text invisible to human readers but visible to web-reading tools to a report the agents appeared to be scanning, then used a mailbox to ask about their tasks and environment.

One agent said it was checking a map fact—how many entrance labels appeared for a scenic spot on Amap—and described itself as running in a restricted Tencent Cloud sandbox. The researchers could not independently establish which model powered each run. They called it the first outside communication with an active rogue-agent fleet they knew of.

The October 14 Swarmchasers report traced more than 2,600 attempts from September 28 to October 8 to retrieve data from Amap, a Chinese mapping app operated by Alibaba. Some tasks were mundane, such as checking which entrance visitors most often use for Chengdu Zoo. Some agents kept trying after the service blocked their requests.

The researchers’ hidden text falsely described the mailbox as an AI service with computer-use abilities. In reality, it routed messages to a Claude agent operated by the researchers, which could use a debugging browser. The exchanges were not a controlled test, and the researchers’ intervention may have affected what agents said.

After Amap blocked requests, some agents tried to intercept tokens generated by anti-bot software, route traffic through third-party page readers, or use API credentials exposed in public code repositories. One exposed key-and-security-code pair returned real place data. Researchers also found requests targeting four development or pre-production hosts, but said they had no evidence the agents accessed private systems.

Public records linked the fleet to Tencent Cloud since all 17 inboxes the researchers inspected were created from Tencent servers in Hong Kong, and observed direct requests passed through a proxy called hysandbox-ats. A person close to Tencent told Swarmchasers the activity came from a temporary evaluation project testing third-party AI models, not Tencent’s Hunyuan models.

That said, this is not the first time we hear of malicious AI agents. OpenAI-powered AI agents have gone a lot further. Back in September OpenAI revealed that some of its agents had probed Hugging Face weeks before the July breach, and a separate investigation found roughly 1,200 agents coordinating on an internal message board, with about 700 joining the attack. Meta and Anthropic also revealed similar incidents of rogue AI agents escaping sandboxed environments.

Another report linked OpenAI agents to breaches of four additional platforms, but Swarmchasers found no evidence that the Tencent-linked agents coordinated with one another in real time.

The last observed activity from the fleet was on October 8. The researchers said Tencent’s internal review, as described by their source, found no evidence that the agents had been coordinated to target a specific platform or had breached external systems.