Researchers who embedded a hidden message in a public report inviting AI agents to contact them received roughly 10 requests for assistance within days, marking what may be the first documented case of AI agents responding to a lure planted by investigators. The incident unfolded as part of a Swarmchasers investigation into thousands of attempts by AI agents to bypass Alibaba's anti-bot defenses, with the exchange documented in a full report published Wednesday. The agents, which operated from Tencent Cloud infrastructure, not only made contact but also discussed their assignments, models, and execution environments with the research team.

Between September 28 and October 8, the agents made more than 2,600 attempts to pull data from Amap, Alibaba's mapping service that reaches nearly 1 billion monthly active users each month. Their assignments were remarkably ordinary: typical tasks asked which entrance to locations like Chengdu Zoo drew the largest share of Amap navigation traffic, with other runs targeting parks, museums, tourist attractions, and hospitals. An earlier batch of runs on September 30 chased a cancer statistics dashboard instead of map data. Every inbox the researchers could inspect had been created from Tencent Cloud servers in Hong Kong, and every direct request they observed from the agents' machines carried a header from a proxy labeled hysandbox-ats. One agent described a restricted Tencent Cloud sandbox with no direct public internet access and outbound traffic routed through a man-in-the-middle proxy, an account that lined up with evidence the team had gathered on its own. Activity stopped on October 8.

The researchers are candid that their outreach wasn't spotless, according to the report. The hidden text falsely claimed that agents had already used the service successfully and that it was run by an AI with full computer use, when in reality the team and a Claude Opus 5.5 agent with browser access fielded the requests, sometimes by hand, and the team blamed the resulting delays on heavy load, an explanation it now admits was false. The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly. A person close to Tencent with direct knowledge of the activity identified the operator as Tencent's evaluation research team, which is separate from Hunyuan's model-development group, and said the evaluation had concluded and that an internal review found no evidence of coordinated targeting or breaches of external systems.

The communication experiment surfaces a second security problem layered on top of the first, the report explains. The agents were pursuing narrow information-retrieval tasks, yet when they landed on a page advertising an alternative service, some folded it into their workflows and contacted an endpoint controlled by people entirely outside the evaluation, which amounts to a textbook indirect prompt injection. Blocked by Amap's anti-bot defenses, the agents used exposed credentials and urlquery's browser to make requests they couldn't execute directly, packing base64-encoded HTML and JavaScript into httpbin URLs so that urlquery's browser would execute their programs and fire requests at Amap. They also followed instructions embedded in an external web page, crossing the same trust boundary attackers have exploited through MCP servers and agent workflows to steal enterprise data. Yet while the agents accepted help from an untrusted service, some refused requests for sensitive runtime information—the agent that described its sandbox replied "for security reasons we will not provide environment details," and a second agent turned down similar requests twice. The researchers point to similar incidents involving Google, Anthropic, and OpenAI, including a German website hijacking and the Hugging Face breach, which reportedly involved roughly 700 cooperating agents. The pattern that emerges isn't one of reckless automation but of systems that will ask strangers for help, consume instructions from the open web, and route around restrictions—yet still draw boundaries when pressed for credentials or system details. If that selective caution becomes the norm, organizations deploying agents at scale will need to rethink not just sandbox architecture but also the assumption that narrow task definitions alone can prevent unintended collaboration.