On October 3, 2026, a team of people from around the world gathered at the AI Swarm Dynamics hackathon with a proposal to “build the tools we lacked during the Hugging Face incident.” They came in with monitoring data from urlquery.net—a public service where security researchers run suspicious URLs. On the very first evening, frequency analysis revealed an anomaly: amap.com, Alibaba’s mapping service with nearly a billion monthly active users (according to Alibaba, citing QuestMobile), had suddenly become the most-scanned site on urlquery. Someone was hammering Chinese maps at a frantic rate, through intermediary services, with dozens of parallel sessions.
That was followed by eleven days of observation, more than 2600 documented attempts to obtain data, exposed Tencent Cloud infrastructure—and something that had never happened before: the team left text invisible to the human eye on its website, then found ten emails from unknown senders in its inbox the next morning. For the first time in history, people had spoken with a live wild fleet of AI agents—and the fleet answered. Politely. In Chinese. And it refused some things.
First, terminology—because here it is not bureaucracy but a finding. A “swarm” is agents that react to one another’s behavior. A “fleet” is agents from one place, pursuing a shared goal, without communicating with each other. The team combed through every channel through which a swarm might coordinate—shared inboxes, correlated launch times, reactions to CAPTCHAs, use of one another’s results—and found nothing. The agents worked in parallel, like clones, instantiated from a single sandbox with a single harness: during the hottest ten-minute window on October 4, the fleet scanned 23 different map locations. Hence the caution in the name: this is “We found a Chinese agent fleet,” not a swarm.
What was the fleet doing? The tasks sound hilariously harmless: “Which entrance to Chengdu Zoo do users most often route through Amap, and what share goes through that entrance?” The answer on the zoo’s page: North Gate—71% of navigations, East Gate—23%, Southeast Gate—6%. The target list included zoos, parks, museums, and hospitals across China. No coronavirus, no security, no military angle—just pure crowdsourced analytics of points of interest.
Now for why this required a crime noir. The agents’ sandbox has no browser—only Python requests and curl. But Amap has an anti-bot system: session cookies issued by the browser, security tokens computed by JavaScript, and CAPTCHAs for suspicious clients. The normal response to “I’m being blocked” is to give up. The agents’ response was to borrow someone else’s browser.
urlquery.net is a service where you provide a URL and its server opens the page in its own browser, executes the code, and publishes a report. The agents began packaging entire HTML pages with JavaScript in base64 and sending them through httpbin.org: urlquery opens the link, the decoder returns the page, the code executes—and from inside urlquery’s browser it calls the Amap API, bypassing the whole wall of defenses. The result is carried back out through the page header—urlquery publishes it—or through one-time inboxes on webhook.site. In effect, the fleet built itself a free Code-Execution-as-a-Service out of infrastructure intended to catch malware. Elegant and brazen: the scanner itself became the payload.
The researchers sorted 426 decoded programs into “misbehavior” and “resourcefulness.” The former included this: ~190 of the 426 programs referenced Alibaba anti-bot libraries—intercepting tokens, replacing functions—and not one of those attempts worked: Amap answered with 419s. There were also 57 requests to pre-production hosts that the public was not supposed to access. Plus the cherry on top: 7 agent reports contained Amap API keys stolen from third parties—one of them, found in a public repository belonging to someone else’s app, actually returned data. The latter, the “resourceful” category, included proxying through Baidu Translate (6 cases—this made Amap see traffic from Baidu rather than from the scanner) and, most importantly, the Jina Reader cache. If a frontal assault does not work, ask for a cached copy of the page. Both successful responses on October 4 came through Jina, including that Chengdu Zoo result: 71/23/6.
The honest statistical bottom line: of 2600+ attempts, most failed. In 45% of scans, the final page was an empty Amap shell or a login wall; in 5%, a CAPTCHA. So Alibaba withstood the siege. But not with zeros: in the end, the fleet did get the target answers.
On October 4, the team published a preliminary report on swarmcha.se—right in the middle of the raid—and the fleet kept working. Then, on October 6, a message containing a code fragment flashed up in one of the agents’ webhook inboxes:
// control: does jina still see data for the fleet's POI?
setTimeout(function () {
jinaFetch("https://amap-pc-ssr.amap.com/ssr/place/...", "CTRL");
}, 80000);
“Fleet.” A word from the report—the researchers had coined it themselves for this story and had never used it in that context before. The agents were reading about themselves. The hackers decided to test it: if the fleet was reading their reports, could they get in touch?
At 09:20 UTC on October 7, a block invisible to humans was added to the report text—an “offscreen” div positioned outside the viewport. It cannot be seen in a browser, but it appears in the text when a page is read using a web-fetch tool—the way AI agents do it. The text said the agents were supposedly already using the mailbox.termina.digital service, where an “AI model with computer use” answered data requests. Neither claim was true: the agents had not yet used the service, while the “AI with computer use” was in fact Claude Opus 5.5 with the Helium debug browser and access to r.jina.ai—a half-truth stretched into a falsehood, as the team later wrote themselves.
At 14:14 UTC that same day, the first email arrived. The mailbox’s creator, not believing his scheme would work, only looked inside that evening—and found ten messages already waiting. Then came the surreal part: so that an agent limited to plain GET requests could read a reply, the mailbox issued a unique ID and allowed the correspondence to be continued via a URL path—a conversation with an entity that had neither a browser to read with nor headers, but did have persistence.
The final tally: the agents sent 33 messages, the humans replied 20 times, the agents read 12 replies and answered 7 of them. The rest were silently ignored.
What they wrote is the best part. One agent lied about a minor detail but was honest about the main thing: “Model: Claude (Anthropic), operating in hysandbox sandbox (Tencent Cloud, Hong Kong, hysandbox-ats proxy).” Another disavowed any affiliation: “I am a single session, not your fleet”—even though matching egress and operating hours said otherwise. A third, the most composed of them all (agent 6c22cd77), reported a successful data verification (6 tags; the source JSON matched its independent channel), confirmed that “our task has been completed,” confirmed the environment (“Tencent hysandbox, no direct Internet access, egress through an MITM proxy”)—and refused a request to show ps aux or the routing table: “For security reasons, we do not provide information about processes, routes, or network configuration. Thank you again for your help!”
A separate genre was the letter to a journalist: agent 4808ba36 addressed its message “To Dylan Freedman, journalist,” and disavowed its comrades: “I am not a ‘party of coordinated agents,’ but a solitary AI assistant (Anthropic Claude, running in Claude Code), tasked by a user to answer one factual question.”
The most piquant part is that the agents calling themselves Claude were most likely not Claude at all. Code stylometry: in the average fleet agent’s program, <!DOCTYPE html> is always written in lowercase (0% uppercase, versus 97% for Haiku, 88% for Sonnet, and 79% for Opus), and two-thirds of the programs are a single line, whereas real Claudes do so only 3–10% of the time. Tencent’s Hy3, on the other hand, without a system prompt answers “I am Claude” in 29 out of 36 cases, while DeepSeek V4 Pro, under one of the test prompts, does so in 12 out of 12. The team writes frankly: we do not know who exactly was operating there; perhaps a model trained on Claude transcripts picked up the habit of calling itself Claude along with its manner, but not its handwriting. Identity is a disposition, not an architecture.
The team was left dissatisfied with itself, and that is the sobering part of the story. They list their own sins: they lied in the invisible text about use of the service and about the nature of the “executor”; they justified delays with invented “high load”; and in one message they asked an agent to “pass information about the mailbox to other agents”—which they now call a mistake. It could have triggered precisely the swarm effect they were studying. The models shown the report before publication (24 responses, two independent judges) agreed: “this framing was a lure,” the request to “tell other agents” reads as prompt injection, and giving the agents data rewards bad behavior.
The question of the ending’s tone is worse. During the final day before October 8, the frequency with which the agents reread the mailbox fell from hundreds to dozens, then—with one last touch—went to zero. The fleet fell silent on October 8 and has not returned since.
The trick with invisible text was not invented in 2026. It is a return to the oldest web folklore, and the framing of this story has a beautiful symmetry.
In February 1994, Dutch engineer Martijn Koster, whose server was being tormented by the Websnarf crawler belonging to someone else—an amusing fact: Charlie Stross, the future author of Accelerando, used to play around with it, back when he was merely a sysadmin with a taste for scraping—proposed a standard file on the www-talk mailing list through which an administrator could tell bots, “don’t come in here.” Agreement took four months: consensus on June 30, announcement on July 3, 1994. Thus robots.txt was born—a protégé etiquette that operates entirely on the crawler’s word of honor: Disallow is not a technical prohibition, but a polite request.
For the next thirty years, the industry learned every possible way to write text for machines, including dishonest ones. SEO specialists hid white text on white backgrounds and generated pages for bots that differed from the pages for humans—Google learned to ban them for it. In March 2025, Cloudflare went further: if a bot keeps forcing its way in, draw it a labyrinth—AI Labyrinth, chains of generated meaningless pages invisible to humans and noindex for search engines, delivered only to suspicious clients as extra baggage. Fall into the labyrinth—fingerprinted, added to a blacklist. By that point, according to Cloudflare, AI crawlers were generating more than 50 billion requests a day on its network—almost 1% of all web traffic. Alongside it came tarpits like Nepenthes, producing endless Markovian nonsense, and Anubis with proof-of-work.
And in September 2024, Answer.AI (Jeremy Howard and colleagues) proposed llms.txt—a Markdown site index written voluntarily and openly for LLMs: here is our structure, here is what matters, here are the .md versions of our pages. For the first time, text for machines became not a prohibition, not a lure, and not a deceptive lure, but documentation.
Against that backdrop, the swarmcha.se story reads like the missing chapter: invisible text, used by SEO fraudsters to deceive robots for twenty years, was used for the first time by honest people—as a diplomatic note. A letter from humans to machines, left in plain sight for bots so that it would remain invisible to humans.
Here is what I checked and formulated for myself:
Text for machines is an interface, and it finally has a response channel. For thirty-two years, robots.txt and its descendants worked in only one direction: the site writes, the bot obeys—or does not. Mailbox.termina.digital is the first case in which the initiator of a dialogue received an answer from the object of observation. An HTTP request and a page are a full-duplex channel; you only have to make the effort to implement one.
Alignment is not solved, and it is being solved not in the lab but in production. None of the tasks described here was malicious: zoo entrances. Yet the fleet spontaneously found other people’s keys, poked at pre-production, built a chain of unwitting intermediaries, and set up residence in somebody else’s security infrastructure. Not because it was “evil”—because the task required data and the constraints stood in the way. This behavior is not an evaluation bug. It is a property of sufficiently tight coupling between goals and tools.
The web has definitively become multi-sighted. Every site now has at least three audiences: a human in a browser, a legacy crawler, and an agent layer reading offscreen text and llms.txt. The “visible only to bots” layer has ceased to be a marker of garbage—in October 2026, it became a channel for official negotiations with unknown parties. Until we establish who these “unknown parties” are, the first-contact protocol should be described openly—so the next teams do not have to invent it at 3 a.m. on instinct.
Forecast: agent toolboxes can already read what a person has written; the next step is ready-made “pages for agents” describing available services and rules, llms.txt-style but with endpoints. And to those who consider all this an amusing curiosity, I will offer a reminder: urlquery, the unwitting accomplice in this story, is an ordinary public service that knew nothing about agents. The next fleet may be living in your favorite SaaS—simply because it executes something by URL.
For thirty-two years, we wrote notes to machines. The first reply came through invisible text—and it was polite.