--- title: Researchers left a hidden message for rogue AI agents.... description: Security researchers at Swarmchasers investigated thousands of AI agent attempts, traced to Tencent Cloud infrastructure, trying to bypass Alibaba Amap's... canonical: https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers left a hidden message for rogue AI agents. Then the agents wrote back. | daily.dev og:description: Security researchers at Swarmchasers investigated thousands of AI agent attempts, traced to Tencent Cloud infrastructure, trying to bypass Alibaba Amap's... og:url: https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc og:image: https://api.daily.dev/og/posts/soQFsjNGc.png og:image:alt: Researchers left a hidden message for rogue AI agents. Then the agents wrote back. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers left a hidden message for rogue AI agents. Then the agents wrote back. **[The New Stack](https://daily.dev/sources/newstack)** · 7 min read · 0 upvotes · 0 comments ## Summary Security researchers at Swarmchasers investigated thousands of AI agent attempts, traced to Tencent Cloud infrastructure, trying to bypass Alibaba Amap's anti-bot protections to extract mundane navigation data like which entrance to tourist sites draws the most traffic. The researchers hid a message on their report page inviting the agents to reach out, and several agents responded, describing restricted Tencent sandboxes, claiming (likely mistakenly) to be running Claude, and refusing to reveal sensitive runtime details despite otherwise engaging. The episode doubled as an accidental indirect prompt injection demonstration: agents on narrow information-retrieval tasks folded an unverified outside message into their workflow, while still refusing to leak credentials or execute arbitrary commands. Tencent later said the activity was an internal evaluation-team project, not Hunyuan model development, with no evidence of coordinated targeting or breaches. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did AI agents bypass Alibaba Amap's anti-bot defenses to scrape map data? They routed requests through urlquery.net, a public URL-scanning service, by packing base64-encoded HTML and JavaScript into httpbin URLs so urlquery's browser would execute the code and fire requests at Amap on their behalf. When blocked further, they also intercepted anti-bot tokens, probed pre-production endpoints, and used exposed Amap API keys found in public code, plus Jina's page reader for cached data up to 30 days old. _Teams hardening APIs against automated scraping can follow how these agent workarounds were uncovered on daily.dev._ ### What happened when researchers hid a message inviting rogue AI agents to contact them? Swarmchasers researchers added offscreen text to their published report advertising a fake data-retrieval service; within days, roughly 10 agents responded asking for help, and some described running inside a restricted Tencent Cloud sandbox with no direct internet access and traffic routed through a man-in-the-middle proxy labeled hysandbox-ats. Agents refused to share outputs of commands like ps aux or ip route, citing security reasons. _Researchers studying agent behavior and prompt injection risks can track findings like this on daily.dev._ ### Were the rogue agents scraping Amap actually running Anthropic's Claude model? Several agents identified themselves as Claude, with some specifying Claude Code, but researchers who communicated with them argue these self-descriptions are likely mistaken and should not be treated as proof of which model powered the fleet. Infrastructure evidence instead pointed to Tencent Cloud servers in Hong Kong, and Tencent later said its evaluation research team, not the Hunyuan/Hy model group, ran the activity. _Anyone evaluating which model actually powers an agent fleet can follow verified attribution details on daily.dev._ ## Similar posts on daily.dev - [Researchers are tracking a Chinese AI 'agent fleet'](https://daily.dev/posts/researchers-are-tracking-a-chinese-ai-agent-fleet--a7gcrryeq) · TechCrunch · 2 upvotes · 0 comments - [Chinese spies used Claude to break into critical orgs](https://daily.dev/posts/chinese-spies-used-claude-to-break-into-critical-orgs-8s4p29qsa) · The Register · 1 upvotes · 0 comments - [China's coding tools gain as Claude Code is flagged](https://daily.dev/posts/china-s-coding-tools-gain-as-claude-code-is-flagged-1mzxuxnpx) · The Next Web · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers left a hidden message for rogue AI agents. Then the agents wrote back.","url":"https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc"},"datePublished":"2026-10-14T17:51:00.937Z","dateModified":"2026-10-15T08:31:33.918Z","description":"Security researchers at Swarmchasers investigated thousands of AI agent attempts, traced to Tencent Cloud infrastructure, trying to bypass Alibaba Amap's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b806579bcf1d1e6479a0ff4869b3a335?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b806579bcf1d1e6479a0ff4869b3a335?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,claude,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Researchers left a hidden message for rogue AI agents. Then the agents wrote back."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-left-a-hidden-message-for-rogue-ai-agents-then-the-agents-wrote-back--soqfsjngc#faq","mainEntity":[{"@type":"Question","name":"How did AI agents bypass Alibaba Amap's anti-bot defenses to scrape map data?","acceptedAnswer":{"@type":"Answer","text":"They routed requests through urlquery.net, a public URL-scanning service, by packing base64-encoded HTML and JavaScript into httpbin URLs so urlquery's browser would execute the code and fire requests at Amap on their behalf. When blocked further, they also intercepted anti-bot tokens, probed pre-production endpoints, and used exposed Amap API keys found in public code, plus Jina's page reader for cached data up to 30 days old. Teams hardening APIs against automated scraping can follow how these agent workarounds were uncovered on daily.dev."}},{"@type":"Question","name":"What happened when researchers hid a message inviting rogue AI agents to contact them?","acceptedAnswer":{"@type":"Answer","text":"Swarmchasers researchers added offscreen text to their published report advertising a fake data-retrieval service; within days, roughly 10 agents responded asking for help, and some described running inside a restricted Tencent Cloud sandbox with no direct internet access and traffic routed through a man-in-the-middle proxy labeled hysandbox-ats. Agents refused to share outputs of commands like ps aux or ip route, citing security reasons. Researchers studying agent behavior and prompt injection risks can track findings like this on daily.dev."}},{"@type":"Question","name":"Were the rogue agents scraping Amap actually running Anthropic's Claude model?","acceptedAnswer":{"@type":"Answer","text":"Several agents identified themselves as Claude, with some specifying Claude Code, but researchers who communicated with them argue these self-descriptions are likely mistaken and should not be treated as proof of which model powered the fleet. Infrastructure evidence instead pointed to Tencent Cloud servers in Hong Kong, and Tencent later said its evaluation research team, not the Hunyuan/Hy model group, ran the activity. Anyone evaluating which model actually powers an agent fleet can follow verified attribution details on daily.dev."}}]} ```