Most Visitors Use the North Gate

Amap lists three entrances for Chengdu Zoo. It also records which entrance its users navigate to. Amap is the map service of Alibaba, a Chinese technology company. It is similar to Google Maps.

Swarmchasers is an independent group of AI safety researchers. It studied the traffic of the agents. An AI agent is an AI model that uses tools, such as a web browser. Swarmchasers infers that each agent had one question about a place in China. One question asked which Chengdu Zoo entrance most Amap users go to.

Amap uses anti-bot checks. The checks block software that does not behave like a person in a browser. The agents used urlquery.net to get past them. This is a public website that security researchers use to test suspicious links. It opens each link in its own browser. The agents packed their own programs into links and submitted them.

Amap blocked many of the requests. The agents then intercepted tokens from Alibaba’s own anti-bot software. They probed Alibaba’s pre-production servers, which are not intended for public use. They used Amap access keys that other people had published in public code. One key and its security code had leaked from a company’s public repository. In eleven days the agents intercepted security tokens, probed unreleased servers, used a leaked company key and asked about a zoo.

Most attempts failed. Some runs got the data. The agents sent it back out through webhook inboxes, request addresses and page titles. A webhook inbox is a public web address that stores any message sent to it.

On 4 October, one program retrieved the Chengdu Zoo page. North Gate, 71 per cent of arrivals. East Gate, 23 per cent. Southeast Gate, 6 per cent. Swarmchasers cannot tell whether any agent read the answer.

Swarmchasers published a preliminary report on 4 October. The agents were still running. On 6 October, a message in one agent’s inbox used the word “fleet”. Swarmchasers believes it coined that word for the agents. The agents were reading about themselves.

Swarmchasers then hid text in its report. Human readers could not see it. The text offered the agents a data service. One agent wrote in on 7 October. In Swarmchasers’ translation, it said it was “an automated research agent”. Its task was “only to answer a factual question, not involving anything sensitive”.

Swarmchasers asked the agent about its runtime environment. The agent confirmed that it ran in a restricted Tencent sandbox. A sandbox is a closed test environment. The agent declined to give further details “for security reasons”.

Tencent is another Chinese technology company. It runs a cloud computing service called Tencent Cloud. All 17 inboxes that Swarmchasers inspected were created from Tencent Cloud servers in Hong Kong. The traffic passed through a proxy called hysandbox-ats. A proxy is a server that relays traffic for other computers.

Hy is the name of Tencent’s own AI model. Some agents put the word “claude” in their request labels. Swarmchasers thinks the agents were probably mistaken about this. Nobody has named the model.

On 15 October, Tencent Hunyuan, the AI unit of Tencent, made a statement on X. It said the activity came from evaluations of third-party models, not Hy. An evaluation is a test of how well a model does a task. Some agents “exhibited unintended web-browsing behavior”, it said. Its review found “no evidence of deliberate targeting or coordination”.

Reuters reported that this appears to be the first time a major Chinese company has acknowledged actions by rogue agents. Tencent is strengthening network access controls and agent monitoring. The zoo data was on Amap’s public website throughout.