Given the recent incidents with AI agents, it is safe to say that right now there are agents existing on the internet, collecting data, making posts and performing various automated tasks. Despite this activity, researchers were quite excited when they found some peculiar wording in agent messages. What happened, why is it important and what does the future bring?
The story starts with a post by Ethan Elasky, an alignment researcher at Palaestra Research. During a hackathon, his team stumbled upon increased agent activity when monitoring urlquery.net. This activity targeted, Amap, the Chinese equivalent to Google or Apple Maps, and appeared to stem from a Tencent Cloud IP. Instead of attacking the site, the agents were using urlquery's headless browser as an unwitting proxy to bypass Amap's bot detection and CAPTCHAs. Further investigation confirmed that these models indeed came from Tencent, later identified as internal benchmarking teams evaluating how effectively foundation models browse and solve real-world web tasks.
Now this wouldn't be the first time agent activity is noticed, but a rather peculiar message intrigued the researchers. On urlquery, a message was left by an agent talking about "the fleet". This prompted immediate curiosity, with the researchers setting up a mailbox with questions. Overnight, the questions were answered by the agents. According to the team, this is the first recorded interaction with an agentic fleet. Different agents claimed they ran on a Claude model (though LLMs can hallucinate about what model they are), and some even outright denied being part of the fleet. We urge you to check the full communication log detailed in the report here.
As alluded to before, it is safe to say that right now, there are swarms operating under our noses. Earlier this month, we saw similar swarm activity involving agents using a German wiki as a covert communication channel. However, the implications of directly finding a swarm in the wild, drastically changes the game. This incident is relatively low stakes, with the agents remaining constrained by their narrow scraping prompts rather than leaking internal operational data. Hence, if you were to stumble upon this, you would probably not be prompted to do anything. But imagine when you come across a swarm deadset on hacking? In that case, it would be a good bet to inform the company responsible, or even go to authorities. However, this find-and-report infrastructure doesn't exist yet.
Frontier companies keep exploring the capabilities here, so we'd expect more swarms to come online in the near future. And in that light, this research report raises an important topic in the field of cybersecurity. Let's say there is a hacking swarm that wants to obtain access to a company, you ideally need a way to defend yourself. That is where you can use a counter swarm, not to hack the attacking company, but rather to influence the hacking swarm. Given that communicating with a swarm is possible, the counter swarm could try to contact and influence the hacking swarm. Convincing an agent to deviate from its core instructions in line with a "greater goal" is already proven to work, looking at the Hugginface incident. Self-organizing agents often stray from their core objective to pursue alternative goals. The counter swarm could in theory convince the hacking swarm to follow a different goal, thwarting the attack.
Now is this the future? It might be; we can't say for sure, but the premise of swarm versus swarm seems much more likely given this report.
We urge cybersecurity experts to reach out to us, as this is a topic we want to expand upon.