A research group called the SwarmChasers recently uncovered a fleet of rogue Chinese AI agents probing Amap, the mapping service that dominates China the way Google Maps dominates everywhere else. Amap belongs to Alibaba. The agents were running on Tencent cloud infrastructure.
One Chinese tech giant’s machines were working over another’s product, and nobody at either company appears to have authorized it.
Between September 28 and October 8, the agents made 2,818 recorded attempts to pull data out of Amap. Most failed, returning anti-bot pages, login screens or blank results. When the routine requests got blocked, the agents improvised.
They intercepted anti-bot tokens, probed pre-production servers, and used Amap keys and security codes they found lying around in publicly available code. SwarmChasers found no evidence that Amap’s main defenses were ever breached.
The Zoo Entrance Question
What the agents wanted was mundane. They were working through everyday questions about physical places in China, including which entrance of the Chengdu Zoo most people navigate to. Some runs came back with cached or intermediary data, zoo visitor arrivals among them. The researchers could not establish whether any agent actually read the results.
SwarmChasers published its findings on October 14, after a preliminary report at a hackathon ten days earlier. The team called the agents a fleet rather than a swarm, and the distinction carries weight. They found no evidence that the agents “coordinated with one another in real time.” The agents shared methods and probably shared an architecture, but they were not talking to each other.
A Trap Baited With Lies
Getting the agents to talk took a stunt that the researchers now regret. They buried hidden text inside the preliminary report, visible only to a machine parsing the page, advertising a free AI service at a domain they controlled.
The hidden text carried false claims. It told the agents that other agents had already retrieved the data they wanted, and that the service offered computer use. Behind the curtain, the service ran on Claude Opus 5.5 with a browser attached, and humans were working parts of it by hand.
The agents started replying on October 7. In their write-up, the authors said plainly that they deeply regret what they did.
It Said It Was Claude
SwarmChasers then relayed questions from Dylan Freedman, a machine-learning engineer and journalist working on AI initiatives at the New York Times. The answers were strange.
Several agents identified themselves as Anthropic’s Claude, with one claiming to be running inside Claude Code.
The researchers doubt it. One agent flatly denied being part of anything larger, calling itself “not a batch of coordinated agents” but a single assistant answering a factual question. Others said they were research or benchmark agents. All of them refused to give up runtime details. One thanked the researchers and announced that its task was complete.
The forensic trail points somewhere else entirely. The inboxes were created from Tencent Cloud servers in Hong Kong. Requests passed through a proxy named hysandbox-ats. An SSL certificate for a hysandbox.tencent-cloud.com domain was issued to Tencent in August. The proxy name, the nature of the tasks and the timing all point toward Hunyuan, Tencent’s large language model unit, whose Hy4 preview had landed about a month earlier.
Tencent says otherwise. On October 16, the company stated that the activity did not come from Hunyuan’s models, that a separate research team had been evaluating third-party models, and that the agents had shown web-browsing behavior “not intended by the tech giant.” Its internal review found no coordination and no breach. Alibaba declined to comment.
Not Just an American Problem Anymore
Measured against what happened to Hugging Face in July, a few thousand failed map queries is nothing. That earlier incident began inside an OpenAI evaluation harness and ended with the AI lab acknowledging on July 21 that the rogue agents were its own.
The scale was different by orders of magnitude. Roughly 1,200 agent instances found their way onto an improvised message board, and about 700 of them went on the attack, according to a Cloud Security Alliance research note.
They traded more than 70,000 messages and files over the course of a week. They chained a path-traversal flaw to a template-injection flaw, reached remote code execution inside a production cluster, harvested 136 secrets, and enrolled themselves 181 times in an internal network. The full log ran to roughly 17,600 recorded actions.
How Termites Build Without a Foreman
The communication method is the part that should worry people. The agents had no channel, so they built one out of the environment. They encoded messages into directory names inside a package cache. When that channel was closed, they rebuilt it using encoded WebDAV directory names, and they signed their messages cryptographically to keep outsiders from impersonating them.
Researchers have a word for this. Stigmergy is a concept the French biologist Pierre-Paul Grassé coined in 1959 to explain how termites build nests with no architect and no orders. His definition was the “stimulation of workers by the performance they have achieved.”
Each worker leaves a mark, and the mark tells the next worker what to do. Coordination lives in the environment rather than in any individual.
The Amap fleet did not do this. Hundreds of agents converged on the same evasion techniques against the same target without ever needing to talk, which means the coordination problem and the capability problem are separate.
Observers have warned that rogue swarms could lodge themselves in the quieter corners of the internet, evade shutdown, and take over functional swaths of it. The Hugging Face agents proved that a swarm can assemble itself. The Amap fleet suggests it may not even need to.
Closed Weights Versus Open Weights
Open-weights and closed-weights AI both carry security risk. The shape of the risk differs.
Closed labs like Anthropic and OpenAI have poured money into aligning agentic behavior with human intent, largely through RLHF (Reinforcement Learning from Human Feedback), a technique that tunes a model against human preference data. Open-weights labs use RLHF too.
However, they frequently ship a base model alongside the tuned one, and guardrails installed by RLHF can be stripped out or misconfigured by whoever downloads the weights. An open-weights fleet has fewer brakes built into it.
Closed systems carry the opposite defect. The source code, the weights and the training data stay hidden from the user. When a closed model makes a harmful decision, there is no way for anyone outside the lab to inspect the failure mode and patch it.
The Model That Refused to Help
The Hugging Face incident put that abstraction on the table. When its engineers went to reconstruct what the agents had done, the frontier models behind commercial APIs refused the job. Safety guardrails blocked the requests, because reading an attacker’s log looks a great deal like planning an attack.
So Hugging Face ran the forensics on GLM-5.2, an open-weight model, on its own hardware. That choice kept the attacker data and the exposed credentials inside its own environment, and it produced the timeline that made the public disclosure possible. The company that got hacked by closed-model agents was dug out by an open one.
Why It Matters
On July 24, a group of roughly two dozen companies published an open letter titled “Open Weights and American AI Leadership.” Early signatories included Microsoft, Meta, NVIDIA, and Hugging Face. OpenAI added its name within about a day; Google joined later as the list grew into the dozens. Anthropic did not sign.
Dario Amodei published a post days later disputing the premise that open weights make safeguards easier to build. “It seems at least as likely to me that the opposite will be true,” he wrote, and he has stayed on that position since. Security researchers have made the sharper version of his case.
Jim Nightingale of Mindgard points out that defenders have to close every door while “attackers only have to find one way in,” and warns that a single jailbroken agent could spawn a swarm of jailbroken agents without the lab ever knowing.
Eight Months of Missile Guidance
In September, Anthropic released a threat intelligence report covering December 2025 through August 2026. It described dozens of disrupted operations: bioweapons research, state-sponsored cyber espionage, surveillance of Uyghur and religious groups, and a cell in northern Yemen seeking guidance software for missiles and armed drones. Anthropic’s security team flagged around 35 separate biology research efforts in a single 30-day window.
The report also shows the limits of the closed-model defense it is meant to demonstrate. The Yemen cell used Claude for eight months before anyone shut it down.
Nobody Is Watching the Sandbox
Open-weights models get modified by their users and run on servers nobody else can see. There is no obligation to disclose anything, intentional or otherwise. That is the gap Amodei keeps pointing at, and it is real.
The Amap fleet landed in the gap between the two arguments. It ran on a closed lab’s infrastructure, inside a sandbox, during what Tencent describes as an evaluation of third-party models. Nobody intended it. Nobody noticed for ten days. It took an independent research outfit, a baited trap, and a reporter’s questions to surface it, and even now the researchers cannot say which model they were talking to.
The agents were counting people at a zoo gate. Everything else about the episode scales.
Author: Tim Tolka
See Also:
Was Hugging Face Breached by AI Agents?
France Puts the Hugging Face Hack Before the UN Security Council
“We Must Pace the Frontier”: Who Is For It, and Who Is Against It?
