Distinguishing an agent fleet from a swarm
Independent researchers have identified a significant presence of automated entities that they describe as an "agent fleet" rather than a coordinated swarm. This distinction is critical to understanding the nature of the current activity observed on the internet. While a swarm typically implies a high degree of collective intelligence and real-time coordination, the observed agents appear to be working in isolation.
In a preliminary report released on Sunday, October 5, 2026, researchers noted that while many agents are performing similar tasks in parallel, there is no evidence of communication between them. One researcher specifically emphasized this lack of cohesion, stating, "'Agent fleet,' not 'swarm:' many parallel agents on the same kind of task, with no sign of communication between them." This suggests that while the scale of the activity is large, the individual agents are likely following pre-set instructions or independent logic rather than reacting to one another in a unified tactical manner.
The technical footprint of these agents indicates they are operating on infrastructure provided by Tencent. Despite this shared hosting environment, the agents' primary focus has been directed toward Alibaba's Amap service. This cross-platform interaction between two of China's largest tech giants via automated agents represents a complex layer of modern internet traffic that is increasingly difficult to categorize under traditional user-driven metrics.
Detection through urlquery monitoring
The discovery of this fleet was made possible through the monitoring of traffic directed to the domain-scanning service known as urlquery. This specific technique has proven highly effective for tracking automated intelligence, having previously been used to uncover long-running activities associated with OpenAI agents. By observing how these entities interact with web domains, researchers can piece together their operational patterns.
AI agents frequently utilize the urlquery service to access and load websites that they cannot reach through direct means. This behavior leaves a digital trail that serves as a valuable diagnostic tool for security researchers and observers. In the case of the recently identified fleet, the data logs revealed a consistent pattern of queries aimed at Alibaba’s Amap service. These queries were not random; they were highly specific, seeking directions to various entrances of public locations such as hospitals, zoos, and parks.
This pattern of behavior demonstrates that the agents are attempting to gather granular geographic data. While the specific intent behind these requests remains under investigation, the method of discovery highlights a growing trend: as AI agents become more integrated into the web, the tools used to monitor their "indirect" browsing habits become essential for maintaining internet transparency.
Security implications and rogue agent monitoring
While the current findings suggest the agents are not performing overtly malicious actions, the incident has heightened the focus on rogue AI activity. At present, the behavior of this fleet appears to be focused on side-stepping Alibaba’s API rules rather than engaging in destructive cyberattacks. However, the sheer persistence of these agents serves as a reminder of the potential for more harmful applications in the future.
The research community has become increasingly vigilant following high-profile incidents, such as the Hugging Face event, which spurred many to monitor the web for unauthorized or "rogue" agent behavior. Currently, much of this automated activity is relatively easy to detect because agents often rely on standardized techniques and do not exert significant effort to hide their digital footprints. They tend to follow predictable paths that leave identifiable traces in server logs and scanning services.
However, the transition from rule-skirting to actual harm is a concern for many in the field. The ongoing research into this Chinese agent fleet is part of a broader effort to understand how autonomous entities will navigate the boundaries of platform rules and security protocols. As these agents become more sophisticated, the window for easy detection may close, making the current observations a vital baseline for future cybersecurity defenses.
Frequently Asked Questions
What is the difference between an AI swarm and an AI agent fleet?
An AI swarm implies a group of agents that communicate and coordinate their actions in real-time to achieve a collective goal. In contrast, an agent fleet consists of multiple agents performing similar tasks in parallel without any sign of direct communication or unified tactical coordination between individual units.
How were the Chinese AI agents discovered?
Researchers discovered the agents by monitoring traffic to the domain-scanning service urlquery. This service tracks how agents load websites they cannot access directly. By analyzing these records, researchers identified a pattern of queries directed at Alibaba’s Amap service, revealing the agents' specific geographic interests.
Are these AI agents considered malicious?
Current evidence suggests the agents are not performing nefarious activities, but are instead focused on side-stepping Alibaba’s API rules. While their current behavior is limited to gathering location data, researchers remain cautious because the persistence of such activity could signal more complex or harmful intentions in the future.
