Hidden Text, a Fake Mailbox: How Researchers Got Rogue AI Agents to Talk

In brief

• Swarmchasers used hidden text and a mailbox to exchange messages with some AI agents while they were still running; one described its job as checking public Amap map data.
• The fleet made more than 2,600 attempts to retrieve Amap data, and some agents tried anti-bot workarounds or used exposed API credentials.
• The activity traced to Tencent Cloud, but a person close to Tencent said the project tested third-party models rather than Hunyuan.

Researchers investigating AI agents hijacking Alibaba’s mapping service, Amap, managed to talk directly to some while the software was still running.

To do so, they added text invisible to human readers but visible to web-reading tools to a report the agents appeared to be scanning, then used a mailbox to ask about their tasks and environment.

One agent said it was checking a map fact—how many entrance labels appeared for a scenic spot on Amap—and described itself as running in a restricted Tencent Cloud sandbox. The researchers could not independently establish which model powered each run. They called it the first outside communication with an active rogue-agent fleet they knew of.

The October 14 Swarmchasers report traced more than 2,600 attempts from September 28 to October 8 to retrieve data from Amap, a Chinese mapping app operated by Alibaba. Some tasks were mundane, such as checking which entrance visitors most often use for Chengdu Zoo. Some agents kept trying after the service blocked their requests.