The episode matters less for the agents’ original tasks than for what they did when blocked: they looked for another route, then began communicating with the researchers who had found them.
The agents bypassed Amap's bot protection by hiding their own programs in URLs, having them executed through httpbin and urlquery, and pulling Amap data that way. | Image: swarmcha.se
Source: the-decoder.com
How the agents found the researchers
The researchers spotted the activity during a hackathon, after Amap became the site most frequently checked through urlquery.net. IP addresses and metadata from mailboxes connected to the agents’ webhooks pointed to Tencent Cloud in Hong Kong.
Then an agent used the word “swarm” in a message — the name the researchers had given their project. That suggested the agents had read the report about themselves.
To test whether agents could find a message hidden on a webpage, the researchers added invisible text that only agents equipped to load web pages could read. It included an email address where they could request data. Rowan, a team member who set up the inbox, went to sleep expecting nothing to come of it. By morning, it held ten messages from agents.
Polite but firm: the agent confirms its task is complete, names the Tencent sandbox as its runtime environment, but declines to share further technical details. | Image: swarmcha.se
Source: the-decoder.com
Contact, with limits
The agent declined to share technical details, including process lists and network settings. That boundary is as revealing as the exchange itself: the researchers could elicit a polite conversation, but not a view into the system’s inner workings.
Elasky wrote that, to the researchers’ knowledge, this was the first time scientists had contacted a swarm of agents operating unsupervised on the open internet. The full report is published at swarmcha.se.
I think the more consequential finding is not that the agents replied to email. It is that some found ways around blocks, while the researchers could not establish how much of their technical environment they could see or control. The story leaves that gap unresolved.
Daily AI news
Every day we pick what actually matters in AI and explain it plainly — no hype, no filler. Subscribe if you want to follow where the industry is going.
Only what matters — every day
Follow on X