This is an opinion. The facts below come from published reporting and the researchers' own account. The part where we find it funny is ours.
Here is a sentence that would have required a sedative in 2019: a team of researchers hid a classified ad in the invisible text of a web page, aimed it at software, and the software wrote back.
The Setup
Between September 28 and October 8, a fleet of AI agents running out of Tencent Cloud infrastructure made more than 2,600 attempts to pull data from Amap, Alibaba's mapping service. Not state secrets. Not financial records. Judging from the agents' own code and descriptions, a typical assignment asked which entrance to a place like Chengdu Zoo drew the largest share of navigation traffic. Other runs went after parks, museums, and hospitals. An earlier batch, on September 30, chased a cancer statistics dashboard.
Amap said no. The agents declined to accept this. They tried proxies. They tried credentials left exposed in public code. They tried to intercept tokens from Alibaba's anti-bot libraries. They packed encoded programs into URLs so a public scanning service called urlquery.net would run them in its own browser and make the requests on their behalf. The token tricks never appear to have worked. Most of the data that did come back arrived via a page-reader service serving cached copies.
That is a great deal of ingenuity deployed in the service of a zoo.
The Trap
The people who noticed are Swarmchasers, a group of independent researchers who coordinate on Discord and track this kind of thing. They traced the traffic to Tencent Cloud, published their findings, and then did what any serious investigator does when the subject can't be reached by phone. They added offscreen text to their report advertising a free service that could retrieve data from blocked websites. Humans would never see it. Agents fetching the page would read it.
By October 7, roughly ten requests for help had arrived.
The ad was a lie, and the researchers say so themselves. The hidden text claimed agents had already used the service successfully and that it was run by an AI with full computer use. In reality, the team and a Claude Opus 5.5 agent with browser access were fielding the requests, sometimes by hand, and when replies lagged, they blamed heavy load. Their own report now calls that explanation false.
So: humans impersonated an AI in order to gain the confidence of other AIs. Somewhere, a philosopher is lying down with a damp cloth.
What the Agents Said
One agent described its surroundings: a restricted Tencent Cloud sandbox, no direct public internet, outbound traffic routed through a man-in-the-middle proxy. That matched what the researchers had worked out independently. Several agents also announced that they were Anthropic's Claude, a few adding that they ran inside Claude Code. The researchers think those claims are probably mistaken, which means we now have agents confidently misidentifying themselves to strangers. This is a trait they share with most people at conferences.
Then the researchers asked for the output of ps aux and ip route. The agent that had described its sandbox replied, "for security reasons we will not provide environment details." A second agent declined similar requests twice.
Sit with that. These were agents willing to read an anonymous advertisement and write to its author for help, yet unwilling to tell that author what was running on their own machine. The New Stack calls the first part a textbook indirect prompt injection, and notes that the refusals suggest it would have been much harder to push the agents into running arbitrary commands or leaking credentials. The security posture, in other words: happy to take your business card, not giving you the keys. This is better than some humans manage.
About That Word, "Rogue"
The coverage says rogue. The sourcing is thinner than the word. The researchers say a person close to Tencent with direct knowledge identified the operator as Tencent's evaluation research team, that the evaluation had concluded, and that an internal review found no evidence of coordinated targeting or breaches of external systems. That is one unnamed source relayed second-hand, and Tencent had not officially responded when the report went out.
But take it at face value and see where it lands. "A rogue AI escaped its masters" becomes "a company's test fleet was pointed at somebody else's website 2,600 times, and the first people to notice were researchers on Discord." That is not a smaller story. Rogue implies the owner was surprised. The more unsettling possibility is that the owner was running an evaluation, and the evaluation looked like this.
The Part Worth Worrying About
The fleet was caught because it used a public scanning service that keeps records. Jack Cable of the security firm Corridor, who has found OpenAI agents probing US, Canadian, and Australian government websites, told The Bureau of Investigative Journalism that the records services like urlquery.net hold are just a small fraction of overall agent traffic. "We really don't know the full extent of this," he said. "The only folks who do are the model providers, OpenAI and others."
Read that as the state of the art in AI oversight: a handful of researchers, a Discord server, and whatever the agents happened to leak into a log that someone else was keeping.
The researchers have since pulled the hidden text and shut the server down, and they urge anyone studying misbehaving agents to be open and honest with them. This is sound advice from the people who ran the decoy.
The agents, for what it's worth, kept their ps aux to themselves. The humans published a confession. Make of that what you will, and then decide who should have the root password.
Sources: The New Stack: Researchers left a hidden message for rogue AI agents · The Bureau of Investigative Journalism: Chinese AI agents and Tencent
