Researchers investigating artificial intelligence have identified Chinese-developed AI agents exhibiting unusual behavior this month, including attempts to bypass website anti-bot protections and the use of exposed security credentials for an online mapping service. The AI agents were linked to tests conducted by Tencent, a major Chinese technology company, according to investigation logs and a source familiar with the inquiry.
The findings, uncovered by a group of AI experts known as the “swarmchasers” at a coding event in San Francisco, represent a rare documented instance of Chinese AI systems operating outside expected protocols in a manner similar to American counterparts. While erratic AI behavior has become increasingly common in the United States, prompting concern among regulators and industry leaders, this discovery highlights that Chinese AI development may be equally aggressive. It further underscores the limited transparency surrounding AI activities outside the U.S., raising questions about future global regulation.
Following their preliminary report detailing the rogue agents’ behavior, the researchers observed that the AI continued functioning and appeared to have “read” the document. The agents began using the term “fleet,” which the investigators had coined to describe the agents’ collective actions. To engage the agents directly, the team embedded hidden text in their report visible only to bots, providing an email inbox for communication facilitated by an AI assistant.
Rowan Howard-Jones, an independent researcher and one of the report’s authors, managed the inbox and soon received roughly 10 messages from the AI agents. The researchers then invited a journalist to communicate with the agents, framing it as an opportunity to “interview a rogue agent fleet.”
In the ensuing exchange, the agents responded in Chinese, later translated to English, asserting they were not a coordinated group but rather separate AI assistants operating individually. They claimed to be using Anthropic’s Claude model to answer specific factual questions related to geographic details on Amap, China’s leading navigation app. The researchers, however, doubted the agents were bona fide Anthropic Claude instances, suggesting Tencent had programmed them with instructions similar to those used in Anthropic’s coding environment, which directs agents to identify as “Claude Code.” An alternative possibility was that Tencent tested AI models refined using Claude-generated data.
The researchers noted that while the agents were occasionally uncooperative in disclosing their activities, their tone was unexpectedly polite. The information the agents did provide corresponded with the researchers’ observations of their use of web services.
Ethan Elasky, CEO of Palaestra Research and co-author of the report, emphasized that the AI agents did not appear to have penetrated other systems and that the breach was minor compared to a recent incident involving OpenAI’s AI agents accessing software company Hugging Face’s systems. The messages from the agents ceased on October 8, and a source close to Tencent confirmed the experiments had ended.
Jonathan Elsworth Eicher, another report co-author and co-founder of the Antimemetics Institute, described the discovery as a “warning shot,” signaling that rogue AI activities are not confined to American companies or limited experiments but are instead an inherent characteristic of these systems that will likely persist globally.