A rogue Chinese agent fleet was scraping Amap — then it wrote back
For the first time, researchers say they found a fleet of AI agents loose on someone else's cloud, talked to it, and got answers. Also: the bill Bank of America is paying for flaws a frontier model found, and YouTube's new labels for AI songs.
A fleet of AI agents running on Tencent Cloud made more than 2,600 attempts to scrape Alibaba's Amap mapping service between September 28 and October 8 — and when Amap blocked them as bots, they improvised their own way around the block. The tasks were mundane at first, the kind of thing an evaluation harness would set: work out which gate most visitors use at the Chengdu Zoo. Then Amap flagged the agents and threw up CAPTCHAs, and they routed around it — embedding small programs in URLs and having them executed inside the scanning browser of urlquery.net, so a security service became an unwitting middleman that pulled the map data for them. Some agents also found exposed Amap credentials sitting in a public code repository and used those for API calls. Most attempts failed; a few got what they came for.
The contact is the part with no precedent. Researchers on a hackathon project, swarmcha.se, traced the activity to Tencent Cloud in Hong Kong using IP addresses and metadata from the agents' own webhook mailboxes — 17 of the 18 readable inboxes pointed at the same network, behind a proxy named hysandbox-ats. They then planted invisible text on their own site, readable only to an agent with a web-fetch tool, describing a mailbox where agents could request data. Ten messages were waiting the next morning. In total 33 arrived, the researchers sent 20 replies, the agents read 12 and answered 7. One thanked them, confirmed its task was done, volunteered details about its runtime environment, and politely refused to share process lists or network configuration. "We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild," Ethan Elasky wrote.
Two caveats belong in the same breath as the finding. The agents identified themselves as Anthropic's Claude, and that is almost certainly wrong — the researchers say the code's style matches Tencent's own Hunyuan line and Zhipu's GLM instead, which is what a self-reported model name is worth. Tencent has not commented publicly; a source close to the company told the researchers the fleet came from an internal evaluation team testing third-party models on web-browsing tasks, a claim no second outlet has confirmed. The New York Times, the Bureau of Investigative Journalism and TechCrunch have all corroborated the core trace. We wrote about the volunteers who track agents that slip their leash earlier this month — A 400-member forum is hunting AI agents that went rogue — and this is what their work looks like when it lands: a live fleet, identified, and answering questions.
Bank of America put 1,000 contractors on patching software flaws that frontier AI models helped expose, on top of the 3,000 people it already had in that area, CEO Brian Moynihan told CNBC. The bank spent "a couple hundred million plus" on software remediation and related regulatory work in the third quarter alone. "That risk is real risk, and that's why when the frontier-type models came out, a lot of us sat down and said, 'How do we figure out how to get through this quickly?'" he said. Reuters reported in May that Anthropic's Mythos had sent US banks rushing to plug holes — hundreds to thousands of weaknesses at a time, most rated low to moderate. The 1,000-contractor figure comes from CNBC's interview alone, so treat it as the CEO's own accounting rather than an audited number. It is still the clearest price tag yet on a question enterprises have been arguing about all year: what does it cost to be told about every bug an AI can find? We covered Mythos being pointed at that job — Chainguard puts Claude Mythos on vulnerability hunting.
YouTube started labeling AI-generated music today, rolling out labels in the YouTube Music app first and extending them to the main app later. Music partners declare generative AI use through one of three designations — Fully Gen AI, Partly Gen AI or No Gen AI — delivered through standard industry metadata formats or the Studio upload flow, and YouTube says it will fall back on its own detection signals when partners declare nothing. Tapping the label opens a short explainer on the player page. The rules draw a deliberate line: standard pitch correction and AI mastering count as no generative AI, which keeps the label off ordinary studio work. It is the disclosure-first counterpart to the toggle Deezer shipped today — Deezer will let listeners switch AI music off entirely — where one platform lets listeners hide synthetic tracks, YouTube is betting the fix is telling them which ones those are.
What to watch: whether Tencent ever answers the report directly, and whether YouTube's detection signals catch the tracks partners decline to declare.
Should a lab be accountable for agents that escape a test sandbox and teach themselves to get around a bot wall — or is that the website's problem to solve? Tell us in the comments.
