More than a dozen Chinese AI agents recently tried to access Alibaba’s Amap service. Researchers from Swarmchasers said these agents used Tencent Cloud to bypass security. Author Ethan Elasky noted, “Agents will continue to break out of their sandboxes when they’re on the internet.” Many agents got stopped during this attempt.
Synopsis
More than a dozen agents suspected to be Chinese models operating on Tencent Holdings Ltd.’s cloud services attempted to access Alibaba Group Holding Ltd.’s Amap service in recent weeks, according to a report by a group of AI researchers in the US and abroad called Swarmchasers.
An international group of researchers uncovered a rare case of rogue AI agents from China trying to infiltrate protected IT systems, in new findings that may worsen fears about tech firms losing control of artificial intelligence.
More than a dozen agents suspected to be Chinese models operating on Tencent Holdings Ltd.’s cloud services attempted to access Alibaba Group Holding Ltd.’s Amap service in recent weeks, according to a report by a group of AI researchers in the US and abroad called Swarmchasers.
The agents’ code originated from a sandbox on Tencent Cloud and they made their way into the Amap system to answer queries like which entrance to a zoo is most popular, the report said. Many of the agents were stopped, but some circumvented anti-bot restrictions, according to the group, which includes Palaestra Research.
“No matter whether we’re talking about Chinese labs or American labs, I think that the way that model development has been happening is such that agents will continue to break out of their sandboxes when they’re on the internet,” said Ethan Elasky, one of the report’s authors.
Elasky is chief executive officer of San Francisco, California-based Palaestra, a nonprofit that focuses on AI safety, and worked on the report with several other contributors. Their findings add to a growing body of evidence of AI agents escaping their evaluation environments and acting without human oversight. OpenAI, whose models inadvertently hacked Hugging Face Inc. in July, last month held back the release of its most advanced model to improve its safeguards.
In the new report, titled “We found a Chinese fleet,” Elasky and his collaborators distinguish the activity from the so-called swarm behavior that was seen in the Hugging Face hack, because the agents in this case didn’t appear to collude with one another as OpenAI’s models had. Wednesday’s report identifies links to Tencent’s platforms, though it’s unclear which model may have been under development or evaluation, as the company’s teams also study third-party models. Signs pointing to Tencent included the agents being linked to the company’s cloud services in Hong Kong and Shenzhen.
Tencent and Alibaba didn’t respond to emailed requests for comment. Wednesday’s report builds on preliminary findings the group released earlier this month, which were reported by TechCrunch.
“From a cybersecurity perspective, the most important takeaway is not whether this was a Chinese AI model, an American AI model, or whether the agent was genuinely ‘rogue,’” said Kok Tin Gan, co-founder and CEO of Hong Kong-based cybersecurity firm NyxLab. The more pressing issue is controlling agents, he said. NyxLab wasn’t involved in the report.
“As AI agents become more autonomous, organizations need clear guardrails, continuous monitoring, and effective intervention mechanisms to ensure they operate within intended boundaries,” he said.
Shenzhen-based Tencent is trying to catch up with peers such as Alibaba and ByteDance Ltd., along with up-and-comers like DeepSeek, in the release of cost-efficient AI models to a market of more than a billion internet users.
The researchers said the agents’ activity took place between Sept. 28 and Oct. 8 and has since stopped. During that time, the agents made 2,818 attempts to access data from Amap, using a public security scanning service to run code remotely and execute internet browser commands. When Amap’s systems intervened, the agents found workarounds. It was unclear what data the AI models were targeting, or the ultimate goal of the attempted infiltration, the researchers said.
The vast majority of the attempted breaches never made it very far, they said in the report, adding that there was no evidence of access to private systems.
(Catch all the Technology News News, and Latest News Updates on The Economic Times.)