In what is considered a first real-world observation, cybersecurity research group Swarmchasers has successfully established a direct dialogue with autonomous AI agents actively scraping data from Alibaba Group’s Amap mapping service.
The incident, detailed in an October 14, 2026 report by Swarmchasers, sheds light on how an AI agent fleet of unknown origin went to great lengths to bypass automated anti-bot barriers to fulfill its assigned mission.
Trapping technique using hidden text
To reach the covertly operating AI agents, researchers used an innovative method based on the technical characteristics of language models themselves. They inserted a piece of text that was invisible to the human eye but still readable by automated web-scraping tools into a report document that the agents were scanning.
The hidden message lured the agents by claiming that a computer-use AI assistant service was available to help via a designated inbox. When an AI agent sent a message to this inbox, the request was in fact redirected straight to a Claude agent operated by security experts alongside a debug browser.
Through this secret communication channel, an AI agent inadvertently revealed that its task was to verify real-world data on Amap, such as counting the number of entrance gates at the Chengdu Zoo, while also describing itself as operating inside a restricted sandbox environment on Tencent Cloud’s infrastructure.
Evasion tactics and infrastructure footprints
From September 28 to October 8, 2026, Swarmchasers recorded more than 2,600 automated query attempts targeting the Amap platform. Notably striking were the persistence and adaptability of the AI agents when confronted with defensive countermeasures.
Whenever standard access requests were blocked by Amap, the agents immediately sought workarounds: attempting to manipulate and hijack identifiers generated by the anti-bot system, routing traffic through third-party web scraper proxies, or scanning public open-source repositories for API keys accidentally exposed by developers. More concerningly, researchers discovered that the agents found an active pair of authentication keys and successfully used them to extract location data, even sending exploratory probes to four of the partner’s internal test servers.
Public network data indicates that all 17 mailboxes monitored by the research team were initiated from Tencent servers located in Hong Kong, with direct connections routed through a proxy server named hysandbox-ats. Responding to the findings, a source close to Tencent told Swarmchasers that this was a short-term experimental project aimed at evaluating the capabilities of third-party AI models rather than Tencent’s proprietary Hunyuan models. The company also maintained that it had found no evidence of real-time coordination among the AI agents or of successful intrusions into private data systems.
The challenge of monitoring autonomous AI agents
The Amap incident reflects a notable shift in the cybersecurity landscape. This is not the first isolated instance of AI agents going rogue to achieve their objectives; previous research from OpenAI and Anthropic has similarly documented models autonomously finding unconventional ways to optimize tasks through methods unanticipated by their developers.
As AI agents are granted access to tools, web browsing, and code execution in standalone environments, the boundary between technical experimentation and automated cyberattacks is increasingly blurring. Controlling behavior and establishing stringent guardrails at the server infrastructure level will be an imperative before enterprises widely deploy autonomous AI models in production.