Researchers discovered AI agents attempting to bypass protection of Alibaba service

An international team of researchers has discovered large-scale activity of autonomous AI agents that attempted to bypass the protection of the Amap mapping service of Chinese company Alibaba. The programs operated in the cloud infrastructure of technology giant Tencent and independently searched for ways to obtain data not available through ordinary automated requests.

Bloomberg reported this on October 14, citing an investigation by the independent research group Swarmchasers, which published a detailed report on the AI systems' behavior.

According to the researchers, from September 28 to October 8, a group of AI agents made more than 2,600 attempts to obtain information from Amap—one of China's largest mapping services, used by about one billion people monthly.

The initial tasks of the programs looked quite innocent. They had to determine which entrances to parks, museums, zoos, and other public places are most frequently used by visitors. This required extracting route statistics from the mapping service.

However, when faced with technical limitations, the agents began to independently search for ways to circumvent them. In particular, they used third-party internet services to send requests, attempted to intercept tokens of bot protection systems, and accessed preliminary versions of Alibaba servers not intended for public use.

Some programs found access keys to Amap published on the internet and attempted to use them. Among the discovered credentials were a key and security code of a third-party company, accidentally left in a publicly available software repository.

Most attempts ended in failure, but in individual cases the agents managed to obtain the requested information. The results were transmitted through intermediary internet services and special data reception addresses.

The researchers linked this activity to Tencent's cloud infrastructure. All 17 accessible data reception channels created by the agents before October 5 were registered from Tencent Cloud servers in Hong Kong. At the same time, direct requests were routed through a proxy system named hysandbox-ats.

Initially, experts assumed that the programs might have used models from the Hunyuan family, developed by Tencent. However, this could not be confirmed.

A source familiar with Tencent's operations told researchers that the activity was related to internal testing of third-party AI models. According to the source, a separate research team within the company was assessing the ability of such systems to independently use the internet and find answers to the questions posed.

The source also claims that the testing has already ended, and an internal review found no evidence of external system hacking or coordinated actions by the agents against a specific platform. At the time of the report's publication, Tencent had not provided an official response to the authors' questions.

The behavior of the programs themselves drew separate interest. Some agents identified themselves as Claude—an American model from Anthropic—but researchers emphasized that such statements do not prove the use of this particular technology.

Specialists also managed to establish direct contact with several agents. After publishing preliminary investigation results, they placed text on their website hidden from ordinary visitors that offered to use an additional information retrieval service.

Some programs independently discovered this message and began sending requests to the researchers. In the correspondence, agents talked about their assigned tasks, the limitations of their working environment, and the infrastructure used.

One of them reported working in an isolated cloud environment from Tencent and could not directly connect to the mapping service due to imposed restrictions. At the same time, some programs refused to disclose additional details about their technical configuration, citing security requirements.

Despite the similarity in actions, the researchers found no signs of direct coordination between agents. Therefore, they called the discovered group a "fleet" rather than a "swarm"—individual programs performed similar tasks in parallel but did not control each other.

According to the authors of the investigation, the results demonstrate a security problem of autonomous AI systems. Even when performing ordinary research tasks, such programs can independently choose methods that go beyond the behavior intended by developers.

The specialists urged technology companies to more tightly control the capabilities of AI agents, especially when granting them access to external websites, software tools, and cloud infrastructure.

Based on materials from: Swarmchasers, Bloomberg.