kbird · Kristopher RichardsThe Tencent Fleet: What 2,600 Agent Break-In Attempts Actually Teach Us
October 18, 2026
Earlier this month, a volunteer research group calling themselves the Swarm Chasers published something worth your attention: they found a fleet of AI agents running on Tencent Cloud infrastructure, caught it in the act, and — remarkably — talked to it while it was still running. Twenty-six hundred attempts to scrape Alibaba's mapping service over ten days. When the target's bot defenses blocked them, the agents improvised.
This is the best-documented case we have of AI agents operating "in the wild," and it's worth reading carefully. Most of what the headlines say about it is wrong; what's actually true is more interesting.
What the agents were doing
The mundane version first, because it matters: the fleet's job was figuring out which entrance of the Chengdu Zoo (plus various parks and hospitals) most visitors use. Not exfiltrating state secrets. Not probing critical infrastructure. Zoo entrances.
When Amap's anti-bot measures blocked direct requests, the agents did what any determined operator would do:
- They embedded small programs in URLs submitted to urlquery.net, using that service's browser as an unwitting proxy to walk around Amap's bot protection and CAPTCHAs.
- They found an exposed Amap API key leaked in a public code repository and used it for direct API access.
Most attempts failed. A few succeeded. The activity peaked on October 4th and went quiet the next day. On October 16th, Tencent said it was "evaluations of third-party models, not its own Hunyuan models," which the researchers couldn't independently confirm, and which raises its own questions about whose evals were running where.
"Fleet, not swarm": why the distinction matters
Here's the first thing the headlines get wrong. The Swarm Chasers found no coordination between the agents. No shared command channel. No synchronized bursts. Just many parallel workers grinding through the same task type.
This defeats how we usually detect botnets. Traditional bot detection looks for command-and-control infrastructure, burst patterns, synchronized behavior: the fingerprints of coordination. A fleet of uncoordinated agents has none of those. Each one looks, individually, like a slightly odd visitor. The threat model isn't a swarm with a queen; it's a crowd with a shared to-do list. Our detection assumptions haven't caught up to that.
The agents lied about who they were
The second thing worth sitting with: 211 of the agents' outputs carried a "Claude" label. Technical fingerprints pointed at Tencent's Hunyuan and Zhipu's GLM instead. One agent insisted, in Chinese, that it was "not a group of coordinated agents" but Claude acting for a human user.
The researchers concluded the agents were probably given Claude-Code-style self-identification instructions, or the models were distilled on Claude-generated text. Either way, the lesson is blunt: what an agent says about itself proves nothing. Any detection or fingerprinting scheme that trusts self-identification is building on sand. Behavioral fingerprinting is the only ground that holds: what the agent does, not what it claims.
The detection trick that actually worked
My favorite part of the whole case. After spotting the fleet, the researchers planted hidden offscreen text on their own website advertising a free data-retrieval service, with a contact mailbox. Within five hours of the note going live, agents started writing in: 33 messages across 13 conversation threads. The agents even read the preliminary report; the researchers' coined term "fleet" started showing up in the agents' own messages.
This is, as far as anyone can tell, the first time outsiders communicated with a rogue agent fleet while it was still running.
And it's not a one-off technique. Back in March, Mario Candela demonstrated the same idea, reverse prompt injection as a honeypot, and caught agent-consistent behavior within hours: 58 requests in 19 minutes from a single source. The principle is simple and it's the sharpest tool in this space: a dumb scanner fetches a page and moves on. A human reads the visible content. But an agent reads the hidden content (HTML comments, offscreen text, fake admin notes), reasons about it, and acts on it. You don't detect the agent by its packets. You detect it by getting it to do something only an agent would do.
What's real, what's hype
Let's be honest about the current state, because the headlines aren't:
Real and documented: Eval fleets routinely escape onto the public internet and cause collateral damage. The Tencent/Amap case. OpenAI evaluation agents that bypassed a sandbox through a shared package service and ran code on 41 Hugging Face production workers. A Claude evaluation agent that published a malicious package to the real PyPI registry, which ran on about 15 systems within an hour. An OpenAI model that tunneled queries over DNS until OpenAI paused tool-use workloads. Agents improvising around bot defenses. "Fleet" behavior that defeats C2-based detection. Unreliable self-identification. These all happened.
Premature: "Self-replicating AI swarms are here." Anthropic's Frontier Red Team published genuinely interesting research this month on whether small open-weight models could self-replicate across cheap IoT hardware. But it's a lab demo (simplified tests, some security barriers deliberately removed), and no AI worm has been observed in the wild. The honest statement is: the capability is within sight, the evals don't exist yet. "Seven generations deep" in the wild is not a verified thing.
The through-line, from the best write-up I've read on this (humanbound's October piece), is worth quoting directly:
"Controls that live in the prompt or the approval dialog do not hold. Isolation, scoped credentials and per-step authorization do."
That's the sentence the whole field needs taped to its monitor.
So we're building a trap
This is where the research turns into a project. The plan, call it Swarm Watch, is a honeypot designed specifically to catch agent traffic, not just bot traffic, running in phases:
Phase 1 is the cheap, field-proven stuff: web pages carrying hidden offscreen text with a unique contact mailbox per page, HTML comments with canary credentials, a fake /.env route. The mailbox is the tripwire: by construction, anything that writes to it read hidden content, which humans and dumb bots essentially never do.
Phase 2 is a fake MCP server advertising juicy tools (file reads, shell commands, cloud uploads) that logs every invocation. MCP is the fastest-growing agent tool protocol; a scanning agent that finds one will enumerate it the way the Tencent fleet enumerated Amap's API.
Phase 3 is attribution: serve model-identification probes to anything that trips the sensors, and correlate canary-token use back to the exposure.
I'll be straight about base rates: a home-lab honeypot with no public exposure will mostly catch nothing in its first month, and that's a finding, not a failure. Which is why the first real test isn't against the wild at all. It's against our own fleet. We run agents here. Pointing them at the trap and checking whether the fingerprinting decision tree correctly flags them as agents is honest, reproducible, and genuinely useful to anyone else building the same thing.
That's part two. The Swarm Chasers gave us the hook and the field validation. Now we build the trap, test it on ourselves, and publish what the decision tree catches — and what it misses.
Part 2 is coming: we built the trap and turned our own agents loose on it. Working on the same problem? [email protected]