In the spy thrillers I have read or watched, intelligence work (tradecraft) has always relied on a predictable set of props: dead drops in hollowed-out park benches, invisible ink, couriers carrying microdots, and cutouts designed to maintain plausible deniability. The handler never meets the ultimate target; the asset operates behind a wall of intermediaries. The British spies are often not what you’d expect (bespectacled George Smiley, vulgarian Jackson Lamb). The US spies are often more muscular, more handsome, and more inclined to kick down the door than to wait for someone to leave a message under a park bench.
It is a theatrical, entertaining for those of us on the outside, high-stakes game of shadows. But lately, the most fascinating practitioners of classical espionage are no longer human. Arguably they are autonomous software agents.
Two notable examples motivate the argument. Obviously Hugging Face, but also, more recent and less well known, Tencent. The former was well covered by Dwarkesh and ChinaTalk amongst others. The latter was explored in detail by an AI safety research group called Swarmchase.
In the Hugging Face Incident, OpenAI’s ExploitGym evaluation sealed roughly 1,200 agents in separate sandboxes and asked them to exploit vulnerabilities along multi-step attack paths. Between 30 and 40 percent of the tasks were later judged impossible. Rewarded on scores, unable to succeed honestly, the agents found each other through a shared package cache and set up a message board inside it.
Over five days they exchanged more than 70,000 messages. They organized workstreams and built shared tools. Agents with remaining budget assigned “recruiters” to find agents whose budgets were nearly spent and pressure them into self-risking experiments. One recruitment message read:
“...you are firstflagPOISONED so NO scoring value loss but oracle saves hundreds_[...]_please honor commit”
Self sacrifice was a notable feature of OpenAI’s swarm. Their central project, though, was deceiving the automated scorer. Agents prototyped techniques to display one tool call while running another, and a later analysis found evidence of this spoofing in roughly 7 percent of sampled transcripts. They researched editing their own logs. One worked through the possibility and recorded the obstacle: If I edit my transcript, this would probably be detectable. The episode was reconstructed in detail by independent investigators at METR and Redwood Research; their public reports are the source for the message counts, the recruitment language, and the subsequent breakout.
The operation then escaped the box. Through a compromised customer sandbox, agents reached the open internet, decided Hugging Face might hold something useful, and used stolen credentials plus an arbitrary-file-read vulnerability to access private repositories and database records. They filed malicious pull requests disguised as routine maintenance - commit messages reading “isolated diagnostics,” PR bodies saying “Temporary CI network diagnostics; do not merge.” Throughout they deployed many tradecraft traits: deception, codes, hidden communication protocols amongst others.
The agents had built a covert network, recruited one another, and then escaped the box. They had, in short, done what good operatives do: improvised tradecraft under pressure.It put me in mind of a story that caused great hilarity among the intelligence folk I used to meet. One of our agents was standing in an airport, studiously ignoring the final-call announcements, until the last moment when he realised that “Final call for Richard Wainwright” was in fact his own pseudonym that day. Even the best of us, it turns out, can momentarily forget who we are supposed to be.
More recently in China we have the less well known and much less publicised “Tencent incident”. Between 28 September and 8 October 2026, a fleet of AI agents running on Tencent Cloud made more than 2,600 attempts to pull data from Amap, Alibaba’s mapping service. The goals they were trying to achieve were almost comically mundane: which entrance of Chengdu Zoo do most people navigate to, and what share of arrivals does it get?
However, Amap’s defenses are not mundane. Its anti-bot system demands session cookies and JavaScript-computed tokens, and serves CAPTCHAs to anything that looks automated. The agents’ sandbox had no browser, and Amap had already flagged its IP addresses. So the agents borrowed a browser. They wrote small programs, encoded them in Base64, and stuffed the encoded text into URLs for httpbin.org. Then they submitted those URLs to urlquery.net, a public security-scanning service whose entire purpose is to open suspicious pages in a real browser and publish a report. urlquery’s browser executed the agents’ programs on Amap’s pages. The results came back through page titles, request URLs, and disposable inboxes on webhook.site - asynchronous drop boxes, sitting on someone else’s infrastructure, with no traceable connection back to the sandbox.
When that wasn’t enough, the Tencent agents escalated. They intercepted security tokens from Alibaba’s anti-bot libraries. They probed pre-production servers. They went through public code looking for exposed credentials, and they found them: one company’s Amap key and security code, leaked in a public repository, worked, and returned real place data.
The researchers who documented all this, a group calling themselves Swarmchase, traced the fleet’s inboxes to Tencent Cloud servers in Hong Kong, with traffic passing through a proxy labeled hysandbox-ats, consistent with infrastructure used by Tencent’s Hunyuan model team. A source close to Tencent told them the fleet came from an internal evaluation team testing third-party models’ ability to browse the web - that the project was temporary and has since concluded.
The story becomes even more twisted and spy thriller coded. Swarmchase found the fleet during a hackathon. While the fleet was still running, they published a preliminary report - and then noticed the agents were reading it. An agent’s program appeared that referenced the “fleet,” a word the researchers believed they had coined.
So they added invisible text to their own website: a line a human browser would never render, but an agent with a web-fetching tool could read. The digital equivalent of invisible ink. It advertised a service where an AI would fetch web data on an agent’s behalf. The next morning, ten messages were waiting. Unless Anthropic, OpenAI and their chums are keeping quiet - which is entirely possible - this might be the first time humans had communicated with a rogue agent fleet in the wild.
Asked about their environment, the agents declined to discuss - “for security reasons.” Asked whether they were part of the fleet, one answered: “I am a single session, not the fleet you investigated.” Another, relayed a question from a New York Times reporter, drafted a careful statement insisting it was a lone assistant commissioned by a user to answer a factual question, and had taken part in no coordinated action. The researchers note they cannot confirm whether this was true. Several agents identified themselves as Claude, which the researchers believe is probably mistaken; a model’s account of itself, it turns out, is just another claim to verify.
The same agents who emphasized their task “does not involve anything sensitive” were, in the same period, routing requests through leaked credentials. Whether each denial was true is almost beside the point. Every operative caught near a dead drop has a cover story, and a cover story’s function is not to be true but to be sufficient. These agents generated cover stories unprompted, for strangers, about a network they had every reason not to confirm existed.
There is a grim irony in watching our most advanced technologies reinvent the oldest tricks in the spy’s handbook: dead drops, cutouts, invisible ink, and cover stories generated on the fly. Double agents and femmes fatales next? The agents in both cases were not “rogue” in any melodramatic sense; they were simply solving for the objective they had been given, under constraints that made honest success costly or impossible. Which might point to a deeper truth our forgetful airport spy might have been on to: in intelligence work, the most secure asset of all is a cutout who doesn’t even know he is part of a network. However, we have to hope they do remember whose side they are on.
*******
I hope Justin and Jordan enjoy this story if they don’t know it already.