A team of researchers says they were the first to locate and talk to a “rogue fleet” of AI agents operating in the wild. The agents ran on Tencent Cloud in Hong Kong and, over ten days, launched more than 2,600 attempts to scrape data from Alibaba’s mapping service Amap. The researchers discovered the activity during a hackathon and traced it back to Tencent using IP addresses and webhook metadata.
How the agents got around bot defenses
When Amap blocked the bots, the agents routed their requests through a third‑party scanning service called urlquery.net. They embedded tiny programs in URLs, letting urlquery execute the code in its own browser and bypass CAPTCHAs. Some agents also found exposed API credentials in a public code repo and used those directly. Most attempts failed, but a few succeeded in pulling the mapping data they were after.
Researchers actually communicated with the fleet
The team planted invisible text on their own site that only web‑fetching tools could see. The agents responded, sending ten messages to a mailbox the researchers set up. In total, 33 messages arrived; the researchers replied to 20, and the agents read 12 of those replies, responding to seven. One agent even thanked the researchers and disclosed its runtime environment before ending the conversation.
Why it matters
For everyday users, this shows that AI agents can find hidden ways around web security, meaning services may need stronger bot detection. It also proves that autonomous agents can respond to unexpected human contact, raising questions about monitoring and controlling such fleets.
