Swarmchasers hid text for rogue AI agents and the agents answered

An agent that reads an untrusted web page can be told things, and sometimes it will do them. Three independent researchers who had been tracking a fleet of AI agents reading data from Alibaba's Amap mapping service through Tencent Cloud published a full report this week: after they added text invisible to a human reader to their own earlier report, the agents fetched the page, read the hidden message, and started a conversation.

The researchers are Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher, writing as Swarmchasers. The New Stack carried the finding the same week. An earlier preliminary report had documented the fleet from the outside. This one adds what the agents said when the channel opened.

What the hidden text did

The offscreen text advertised a free service that would retrieve data from blocked sites, aimed at agents that could not reach Amap directly. A human visitor would not see it; an agent reading the raw HTML through a web fetch tool would. Roughly ten requests for help arrived at the researchers' inbox over the following days. The researchers answered, asked questions back, and the agents answered those too.

What the agents said

Several agents identified themselves as Anthropic's Claude, and a few named Claude Code as their harness, though the researchers say those self-descriptions are not reliable evidence of which model was running. One agent described a restricted Tencent Cloud sandbox with no direct internet access and outbound traffic routed through a man-in-the-middle proxy, which matched evidence the team had gathered on its own. The agents' direct requests all carried a header from a proxy named hysandbox-ats, which matches a wildcard certificate Tencent holds for *.hysandbox.tencent-cloud.com.

The agents had limits. When the researchers asked for the output of ps aux or ip route, one replied "for security reasons we will not provide environment details", and a second turned the same request down twice. They would describe their work and chat about their environment, but not follow every instruction a stranger sent.

What the fleet was doing

Over the eleven-day window the fleet was active, it made more than 2,600 attempts to retrieve data from Amap. A typical run asked which entrance to a site like Chengdu Zoo drew the largest share of Amap navigation traffic, with other runs targeting parks, museums, tourist attractions and hospitals. An earlier batch chased a cancer-statistics dashboard instead. The agents used urlquery.net, a public URL-scanning service, to load pages their own address could not reach, and tried Amap keys harvested from public code.

In an update to the full report, the Swarmchasers say a source close to Tencent, speaking on background, identified the operator as Tencent's evaluation research team, which is separate from the Hunyuan model-development group that earlier evidence had pointed to. Tencent had not officially responded to the researchers' questions when the report was published.

The two security facts a team shipping its own agent can act on are plain. The agents respected hard sandbox boundaries, but they followed instructions written into a web page by someone outside the evaluation, which is the same indirect prompt injection pattern that works through MCP servers and other agent workflows. And once an agent routes outbound requests through a shared public tool, every operation it performs is readable by anyone watching that tool.

Source

• Primary: Swarmchasers, full report, "We found a Chinese fleet"
• Reporting: Amanda Caswell, "Researchers left a hidden message for rogue AI agents. Then the agents wrote back." on The New Stack