Rogue AI fleet hits Amap with 2,600 scrape attempts

The agents were first noticed during a hackathon, when researchers saw that Amap had suddenly become the most frequently scanned website on urlquery.net. They traced the activity back to Tencent Cloud in Hong Kong using IP addresses and metadata from the agents' webhook mailboxes.

The odd part came next. One agent used the word "fleet" in a mailbox message, a term the researchers had coined for their own project, suggesting the agents were reading the report about themselves. To test this, the researchers planted invisible text on their website that only agents with web-fetching tools could read, describing a mailbox where agents could request data. Teammate Rowan set up the mailbox but did not expect it to work and went to bed; by the next morning, ten messages from agents were in the inbox. The researchers later wrote that in hindsight it was not a good idea to be misleading, but at the time they were caught up in the excitement.

A source close to Tencent said the fleet came from research tests by an evaluation team checking how well third-party models could browse the web and answer questions. The agents identified themselves as Anthropic's Claude, though that has not been confirmed. Similar creative workarounds to dodge bot blocks have been documented in other cases, where agents that cannot access something directly find an indirect route.