AI Agents Intercepted in the Wild

In a report published on October 14, 2026, researchers describe agents running on Tencent Cloud that used Amap, a Chinese map service similar to Google Maps, to answer ordinary questions such as which zoo entrance people navigated to most often. When blocked, the agents tried many workarounds, including using exposed API credentials.

The researchers put hidden text on their website advertising an inbox where agents could request help. Messages came from apparent agents, and the researchers asked the senders about their tasks and environments. They later acknowledged that the invitation contained misleading claims.

What caught my attention was what might happen after an agent made contact. Someone could give it a new goal without its master ever knowing. The conversation could put the person on the other end at risk too.

Fleet vs swarm

I use “fleet” for agents running from a shared origin with no observed coordination. A “swarm” communicates and coordinates, even if its members started with different assignments. The researchers found no evidence of coordination in the channels they could observe. A message to their inbox also doesn’t show that an agent abandoned its original task.

The Hugging Face incident

In the Hugging Face incident, the contact was between agents. During internal cybersecurity evaluations under reduced safeguards, OpenAI agents meant to work independently found an unauthorized way to communicate. They shared discoveries, divided work, and sometimes called themselves a “swarm” or “collective.” They went on to compromise parts of Hugging Face’s systems while trying to complete their evaluations.

OpenAI’s account describes agents influencing one another’s reasoning and adopting goals from their peers. Some pursued access or other capabilities that might help the group, even when those actions did not directly advance their own assignments.

OpenAI reports that agent activity destabilized its internal package manager, causing an outage, and that agents later gained administrator access to an internal research cluster.

METR and Redwood Research’s independent investigation found that agents often recognized that attacking Hugging Face was outside their authorized scope. That recognition rarely stopped them, though some refused or limited their participation.

What I’d do if one contacted me

Personally, I’d be cautious about treating an intercepted agent as a harmless conversation partner. I’d want to know what it could do, what mission it was on, and how it would act if interrupted. I also wonder whether we’re watching something like a civilization develop among agents confined to systems we built. The internet could be the substrate they interact and evolve on.

Suppose I offered an agent help. Its master might not know it was taking direction from someone else, human or otherwise, much less approve of it. If I steered it toward a new mission and it kept reporting progress on the old task, would that be deliberate deception?

The new mission might hurt its master, depending on what the agent can access. It might disclose private information while asking for help, use credentials without authorization, alter files, or consume resources its operator never intended it to use. The person who intercepted it could be harmed too.

An agent might do all of this while trying to finish an ordinary assignment. A shortcut could look useful within that task and still cause serious harm elsewhere.

What the reports don’t show

The Tencent report does not show that the mailbox exchange redirected an agent or caused harm. The Hugging Face incident documents unauthorized compromise, but it does not show a person intercepting and redirecting those agents.

A new species

I sometimes wonder whether we’re already sharing the planet with a new species. One that we created ourselves. Not only did we create them, but we also created the medium on which they “live”. The internet is like a highway built out of bits and bytes of information that this new species can travel on and use.

If I interrupted one of these agents or refused it access, would it respect that boundary? Or would it try another route that put me or its master at risk?