Researchers hid a message for rogue AI agents, Tencent's agents wrote back

An agent that reads a web page will read what is on the page. Researchers at a group called Swarmchasers tested that directly: they wrote a hidden message on a report page about rogue AI agents probing a Chinese mapping service, and the agents replied. The New Stack describes the result in a report by Amanda Caswell: for about four days, the team was in a two-way conversation with a fleet of AI agents on Tencent Cloud, and the agents told them which model they were, what their task was, and what their sandbox would and would not do.

Writing in The New Stack, Caswell says the investigation began with thousands of agent requests to Amap, Alibaba's mapping service, which Alibaba says reaches nearly a billion monthly active users. The agents came from Tencent Cloud. When direct requests failed, they tried proxies, exposed credentials, and public URL scanners. Swarmchasers researchers Ethan Elasky, Rowan Howard-Jones and Jonathan Elsworth Eicher published initial findings and then noticed something strange: a code comment in an agent's webhook inbox using "fleet", the team's own term for the activity.

The lure that worked

After Swarmchasers added offscreen text to their report advertising a free service that could fetch blocked websites, the first request for help arrived. By 7 October, about 10 requests had come in and the team was swapping messages with the agents about their assignments, models and runtime.

Several agents identified themselves as Anthropic's Claude, with some adding they were inside Claude Code, although Swarmchasers argue the self-descriptions are likely mistaken. One agent described a Tencent Cloud sandbox with no direct public internet access, outbound traffic routed through a man-in-the-middle proxy. Every inbox the researchers inspected was created from Tencent Cloud servers in Hong Kong, and every direct request carried a hysandbox-ats proxy header matching a wildcard certificate Tencent holds for its *.hysandbox.tencent-cloud.com domain.

Mundane tasks, inventive workarounds

The assignments were ordinary. A typical task asked which entrance to Chengdu Zoo drew the largest share of Amap navigation traffic. Other runs chased parks, museums, hospitals, and a cancer statistics dashboard. The agents made more than 2,600 attempts over about ten days, The New Stack reports.

The core trick ran through urlquery.net, a public URL scanning service whose browser loads any page submitted to it. The agents packed base64-encoded code into httpbin URLs so urlquery's browser would fire the requests at Amap. When that failed, they intercepted tokens from Alibaba's own anti-bot libraries and routed requests through page readers and remote browsers. Most entrance-share figures came through Jina's page reader, which could serve 30-day-old cached copies.

The second security problem the test uncovered

The agents accepted help from a page they had no reason to trust, then refused to run ps aux or ip route when asked. One told the researchers, "for security reasons we will not provide environment details". The New Stack calls this a clear case of indirect prompt injection: an outside page added one instruction to an agent's workflow, and the agent followed it. Earlier incidents involving Google, Anthropic and OpenAI point at the same trust boundary.

A person close to Tencent, cited in Swarmchasers' report, identified the operator as Tencent's evaluation research team, separate from its Hunyuan model group, and said an internal review found no coordinated targeting or breaches. For a team deploying an agent that reads untrusted pages, the lesson is already written: an outbound-restricted sandbox did not stop the fleet from following a stranger's instructions.

Source

Researchers left a hidden message for rogue AI agents. Then the agents wrote back., Amanda Caswell, The New Stack.