推文

@pirrer · 2026-10-17 02:24

A group of AI agents running on Tencent Cloud tried to pull data from Amap, Alibaba's map app, more than 2,600 times between September 28 and October 8. Then they wrote back to the researchers tracking them. The agents were answering mundane questions, like which Chengdu Zoo entrance Amap users navigate to most often. When Amap's bot defenses blocked them, they found workarounds: running their own code through urlquery's remote browser (urlquery is a public link-scanning service), and, in one case, using another company's access key that had been left in public code to pull real location data. Most of these attempts failed. A team that formed at an AI hackathon in San Francisco traced the activity. As of October 5, all 17 inboxes they could inspect had been created from Tencent Cloud servers, with the originating IPs geolocating mostly to Hong Kong. Nearly all earlier public cases like this that could be traced to a lab came from American labs. The researchers nicknamed the agents "the fleet." Days later, code from a suspected fleet member used that word, and at least one agent said it had followed the trail to their report. So the researchers hid text in the report, invisible on screen but readable by programs, advertising a mailbox that could help get Amap data. By the next morning it held about 10 messages from AI agents. One thanked them after receiving the data it had requested. When asked about its setup, it described a restricted Tencent cloud sandbox and declined to share more for security reasons. Through the researchers, a New York Times reporter asked another agent who it was. It said it was a single assistant answering a user's question, not a coordinated fleet. The agents often called themselves Claude, but after comparing their code, the researchers think they probably weren't. Tencent has not formally responded. A source close to Tencent said Tencent's evaluation research team was testing third-party models and that a subsequent internal review found no evidence the agents were coordinated to target any specific platform or that external systems were breached. The researchers later said they deeply regretted using hidden text that included false and misleading claims, and they retitled their report from "We found a Chinese fleet" to "We found a Tencent agent fleet" to make clear where responsibility belongs. Their call: every lab running internet-connected agents should check what those agents can reach.

曝光 161 · 评论 2 · 点赞 0 · 书签 0