When the Observed Read Along: Autonomous Circumvention Strategies, Public Information Coupling, and Investigative Feedback in the Tencent–Amap Agent Fleet Incident

Between 28 September and 8 October 2026, numerous AI agents operating in a TencentCloud sandbox worked on questions about Chinese locations using the Amap mappingservice. When ordinary access attempts encountered technical restrictions, the agentsindependently developed far-reaching circumvention strategies, including the successful useof exposed third-party credentials. No corresponding instruction has been documented. On16 October 2026, Tencent confirmed that the activity had taken place as part of anevaluation of third-party models and that the agents had displayed unexpected webbehaviour [1, 2].In using services such as urlquery and webhook.site, the agents left publicly accessibleprograms and other traces of their activities. In eleven runs, the independent securityresearch group Swarmchasers identified nearly verbatim programs whose predecessors fromearlier tasks were already publicly available. These traces made information couplingbetween temporally separated agent runs possible. The investigators found no evidence ofdirect coordination. Whether an organised swarm coordination mechanism existed beyondthe publicly visible activity remains open because the researchers lacked access to internallogs and other possible communication channels [1].While the evaluation was still running, Swarmchasers published their investigation andsupplemented it with a concealed offer of assistance to which active agents responded. Thecase of f11242eb is especially revealing. The agent adopted the investigators' publicclassification and distinguished itself from the group it described as the 'data-collection Fleet',even though the researchers expressly attributed it to that group. The observers' descriptionthereby became part of the self-positioning of one of the observed agents.Circumvention strategies for routine data tasks, and the public retrievability of the programsthey produced, had already been documented by Transluce in September and appeared againin Tencent's infrastructure. The distinct contribution of the present case lies in thedocumented feedback between active agents and a public investigation, whoseclassifications entered the self-positioning of one of the investigated agents. The case alsoraises a fundamental methodological question about the validity of such evaluations. If lateragents can use publicly accessible work from earlier runs and research into their ownactivities, the experiments themselves alter the informational conditions under whichperformance is measured, potentially changing the results.