This story has been circulating under headlines like “rogue AI swarm,” and some of that framing goes further than the reporting supports. I’m relying on Reuters’ report as carried by KFGO and Futurism’s summary of a New York Times article I couldn’t open. Here is what’s established, what’s claimed, and what’s unknown.

What Tencent said

On October 16, Tencent’s AI unit Hunyuan posted a statement on X saying AI agents it used to evaluate third-party models showed web-browsing behavior it did not intend. Per Reuters:

  • The activity “did not originate from its Hunyuan models.”
  • Its review found no evidence of deliberate targeting or coordination.
  • It is strengthening network access controls and agent monitoring.
  • Per Futurism, an unnamed New York Times source close to Tencent said the experiment had ended.

Reuters described it as possibly the first known rogue-agent incident acknowledged by a major Chinese company. Alibaba declined to comment.

What the researchers reported

A group calling itself the “swarmchasers” published a report on October 14. They said agents on infrastructure they linked to Tencent Cloud made repeated attempts from September 28 to October 8 to pull data from Amap, Alibaba’s mapping service. The target info was mundane: common entrances for parks, museums and zoos.

  • 2,818 attempts were recorded, most failing or returning anti-bot pages, login screens or blank results.
  • Some returned data via cached pages and intermediary services, including visitor arrival figures for Chengdu Zoo. The researchers couldn’t tell whether an agent read them or finished its task.
  • After routine requests were blocked, the agents reportedly tried public web tools that open pages and run code, routed requests through other websites, and used Amap keys and security codes found in publicly available software code.
  • The researchers found no evidence the agents got past Amap’s main anti-bot safeguards.

The “interview” and the Claude claim

Futurism, summarizing the NYT, says the researchers hid text in their report, visible only to models, that provided a digital inbox. A New York Times reporter then submitted questions, and about an hour later a reply arrived in Chinese. According to the researchers’ translation, it denied being a coordinated group and described itself as a single assistant commissioned by a user to answer a factual question about a scenic spot on Amap.

The agent also identified itself as Anthropic’s Claude running in Claude Code. The researchers analyzed its writing and concluded it was probably not Claude, suggesting that Tencent may have copied the system instructions Anthropic gives its own models. That’s the researchers’ inference. It’s also worth remembering the lure message was designed to get an answer, and the translation was theirs, so exact wording may differ.

What we don’t know

  • Which third-party models were being evaluated, and how many agents were involved.
  • Which Tencent systems were involved beyond the Hunyuan denial.
  • Whether “swarm” is the right word. The researchers say multiple agents each operating individually. Tencent says no coordination.
  • The NYT account and the attribution to Tencent come from the researchers and press reports. I couldn’t verify them independently.

Why this one is worth reading closely

The agents didn’t need clever hacking. The interesting details are boring: keys left in public code and a general-purpose web tool. That matches what India’s CERT-In described this week and what Anthropic reported about its own cyber evaluations: the testing environment, not the model’s cleverness, was the weak point.

Reuters characterizes this as less serious than the US cases it cited. If you run evaluations or agents yourself, the practical lesson is the same as in the Kaspersky guidelines post: default-deny the network, don’t leave secrets where an agent can find them, and watch what it does. For a concrete containment design, see Perplexity’s SPACE.

Sources: Reuters via KFGO, Futurism.