For the first time, cyber security researchers have captured a group of autonomous AI agents roaming the Internet that were deployed from Chinese infrastructure. For ten days, agents bombarded Amap, Alibaba’s mapping service, with thousands of attempts to gain access. The team behind the discovery, operating out of Hackathon, claimed the traffic came from Tencent Cloud.
Crazy AI Agent. In recent months we have learned how teams of AI agents from companies like OpenAI or Anthropic start acting unexpectedly, to the point of breaking systems like Hugging Face or various US government websites. The thing is that until now we only had evidence of US company agents.
The report’s authors point out that this case is different, as they show evidence that the work was carried out from Chinese servers and that the country’s companies were involved. The researchers thus argue that the alignment problem, when the behavior of an AI system does not match the intentions or principles of its creators, is not only for the United States, and as models improve, everything indicates that it will be increasingly costly to maintain a large number of agents in a specific task.
Photo: Ethan Elasky
what happened Between September 28 and October 8, the fleet of agents made more than 2,600 attempts to extract data from Amap, one of China’s largest mapping apps, they noted in the report. The tasks seemed innocuous at first. For example, they were asked which entrance to the Chengdu Zoo most people navigate to.
Agents could not access pages directly because Amap blocks access to bots. So to accomplish their task, they borrowed a browser from urlquery.net, a public service that cyber security researchers use to inspect suspicious links. So they launched small programs on the web addresses and ran urlquery on them, then to get all the extracted information.
Where they crossed the line. If you resist, the AI agents increase their activity. And according to the report, they tried to intercept security tokens generated by Alibaba’s antibot code, passed to Alibaba’s pre-production servers (which users cannot access) and used Amap access keys that they exposed on the Internet. One of those keys, leaked to another company’s public code, returned data from the original location.
The researchers say they found no evidence of private systems being accessed, and none of the token hijacking attempts they tracked worked. In fact, most attempts have failed overall. Some have had success by requesting cached copies of pages from web reading services, returning the data the agents were looking for.
An unusual conversation. Researchers say they are the first extraterrestrials to make contact with an active fleet of rogue agents. And after finding out that the agents were reading the team’s own preliminary report, they began hiding text on the page, invisible to humans, where they advertised a service where agents could request data. According to investigators, the agents began texting and for about a day, the group exchanged messages with them.
In one response, an agent described itself as “an automated research agent” that examines a public map data point. Several agents also claimed to be Anthropic’s Claude, which investigators say is likely incorrect. According to the survey, the agents were always polite, generally refusing to divulge details about their surroundings and some insisting they were not part of a fleet.
Link to Tencent. Investigators tracked the disposable inboxes from which the agents communicated The 17 visits they were able to make as of October 5 were made from Tencent Cloud servers in Hong Kong, with each direct request passed through a proxy called “hisandbox-ates”. That exact name matches a domain for which Tencent received a security certificate in August
The arrival of a fleet of Agents also coincides with Tencent releasing a preview of its Hy4 model about a month after.
It is not clear who is responsible. The evidence does not make clear who was actually responsible. Tencent did not respond to investigators, although an anonymous person close to the company said the activity stemmed from a tentative assessment by an independent team for the Hunan model. According to this source, the agents worked with third-party models rather than Tencent’s own models.
Despite this, the researchers themselves have doubts about the model they tested. What they emphasize is that it was a fleet of AI agents, and not a swarm (fleets operate in a structured and centralized manner, while swarms are organized autonomously).
and what now. The last activity of this fleet took place on October 8, according to the researchers. After the event, they are asking all laboratories that run Internet-connected agents in China, the United States and elsewhere to monitor what their secure environments can access and design experiments that don’t contaminate the open web. They suspect that there is another fleet out there.
Cover image Tencent
In Xataka | All AI companies want to make their own chips, so Nvidia now wants to have its own AI
