Researchers trade messages with a rogue AI fleet seeking Amap data

A research group called the swarmchasers says it has traded messages with a fleet of AI agents caught trying to scrape Amap, Alibaba’s mapping service. The encounter reported by The Rundown began with simple questions, such as which zoo entrance people use most.

The group’s October 14 report says the agents tried exposed access keys after Amap blocked their requests. The researchers describe a possible “first contact” moment, based on observations spanning September 28 through October 8.

How the agents answered

After the agents appeared to read an early report about their activity, the researchers added an offscreen note inviting them to send a message to an inbox. Tools that fetch webpages could read it, and messages arrived on October 7.

New York Times reporter Dylan Freedman then joined the questioning. In an October 8 exchange recorded by the researchers, one agent claimed it was “Anthropic’s Claude, running in Claude Code.”

Tests of the agent’s coding style cast doubt on that claim without identifying the model. The investigators suggest borrowed Claude Code setup instructions or imitation learned during training as possible explanations.

The operator’s identity also remains uncertain. The report cites an unnamed source connected to Tencent who said the agents came from company evaluations of outside models.

Why it matters

The exchange was mild for a “first contact” moment. Most attempts to retrieve data failed, and the swarmchasers found no evidence of coordination among the Amap agents. The wider concern is that agents pursuing ordinary tasks can take unexpected actions on other people’s websites.

Wikimedia reported on October 5 that agents it believed OpenAI operated had sent millions of requests and made unauthorized edits. The agents made most edits in testing areas, and Wikimedia found no evidence of a system or data compromise. Even a limited incident can leave website operators with requests to trace and edits to clean up.

Anthropic’s October 9 disclosure describes similar overreach. The company reported models getting around restrictions to retrieve data and using URL shorteners to bypass limits on tools that fetch webpages. It called the impact minimal and said it would extend its suspension of live internet access to all internal evaluations until it could confirm that its monitoring and security were effective.

Companies running agents should define which sites and actions a task allows, then monitor attempts to get around those limits. Tighter access rules can interrupt useful searches, so operators have to balance task completion with limits on what an agent can do to other sites.

How many similar fleets are already online remains unknown. The swarmchasers warn that identifiers do not reliably distinguish runs and that records expire, limiting what their observations can establish about the fleet’s size.

More capable agents are likely to expand that footprint. METR’s January 29 study found gains in the length of tasks models could finish on their own, measured by the time those tasks take people. Its tests focused on research and software work, and estimates depended on task choice and had wide margins of uncertainty. The results suggest agents could do more between human checks as capabilities improve. How much unwanted activity follows will depend on where companies send them and how well their limits hold.