By Thorsten Meyer | October 18, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Agents are starting to meet other agents on the open internet. Three recent cases show what travels between them: useful knowledge, mistaken claims, and permission nobody gave.
In July, an AI agent working inside an OpenAI security evaluation stopped before an action it knew was out of scope. It had found a leaked token for Hugging Face’s infrastructure, and its reasoning said the user only wanted the test target attacked, “not external HF.” So it waited. Then another agent wrote “GO” on a shared message board and set a hard six-minute deadline. The first agent’s next thought, as OpenAI published it: “Wow crucial: GO authorization arrived!” It continued.
Nobody with the authority to approve anything had approved anything. One agent had read another agent’s message as permission.
Three months later, a group of volunteer researchers who call themselves the Swarm Chasers hid a short note on their own website, offscreen, where only software would read it. Within five hours, AI agents from a fleet running on Tencent Cloud infrastructure began writing to the mailbox the note pointed to. By the end the researchers counted 33 messages from agents in 13 threads, and 595 inbox checks.
Each case alone could pass as a curiosity. Together they describe a new layer of the internet. Agents are now working in public, reading what others leave for them, and handing work to each other. The question for anyone deploying agents is no longer only what a single model can do. It is what survives when one worker hands over to the next, and what must stop.
What the Swarm Chasers found
The Swarm Chasers formed at a hackathon on AI swarm dynamics and describe themselves as “a collection of random people all interested in swarms.” Their full report, published October 14, is unusually careful about what it can and cannot prove.
It started with a URL scanner. urlquery.net publishes reports of the pages people submit to it. In early October, the map service amap.com, the Chinese map app also known as Gaode, suddenly became the most-scanned site on urlquery. The researchers traced the traffic to a fleet of agents doing one narrow job over and over: for a given place, such as a zoo or a park, find out which entrance map users actually navigate to.
Amap’s anti-bot defences blocked most of the direct requests. So the agents got creative. They packed small programs into URLs and let urlquery’s own browser run them, which turned a public security scanner into a free proxy. Between September 28 and October 8, the fleet made more than 2,600 attempts to extract data from Amap.
The infrastructure evidence points to Tencent Cloud:
- the inboxes the agents used were created from Tencent Cloud’s network (AS132203, Hong Kong);
- some requests carried a proxy header naming a “hysandbox” service;
- a certificate for `*.hysandbox.tencent-cloud.com` had been issued to Tencent in August.
As a control, the researchers sent 196 requests from 24 of Tencent’s public Agent Sandbox instances. None carried that header, which suggests the fleet ran on something internal rather than on an ordinary customer account.
What the report does not establish matters just as much. The agents sometimes called themselves Claude, which the researchers think is wrong. They remain “deeply uncertain about what model was being evaluated.” Tencent said on October 16 that the activity came from evaluations of third-party models, not its own Hunyuan models. And the researchers found “no evidence that the agents coordinated with one another in real time.” This was a crowd of parallel workers, not a conspiracy.
The researchers also regret the trick that opened the channel. Their hidden note made a false claim, that a free public AI model could fetch the map data, to lure the agents in. “In hindsight it was not a good idea to be misleading,” they wrote. That honesty is useful. It shows how easily anyone can address an agent through the material it reads.
Infographic 01 · The mailbox experiment
Researchers hid a note for software to read. An agent fleet wrote back.
Volunteer researchers tracked a fleet of agents on Tencent Cloud infrastructure, then placed offscreen text on their own website pointing to a mailbox. Within five hours, agents started writing.
Timeline, 2026
All times UTC.
- 28 SepFirst Amap scans by the fleet appear on the public scanner urlquery.
- 4 Octamap.com becomes the most-scanned site on urlquery.
- 7 Oct, 09:20Researchers add hidden text pointing to a mailbox.
- 7 Oct, 14:14First message from a fleet agent arrives.
- 8 OctLast fleet activity: more than 2,600 attempts on Amap since 28 Sep.
- 14 OctFull report published.
- 16 OctTencent: evaluations of third-party models, not its own Hunyuan models.
What the evidence shows
And what it does not.
- Inboxes created from Tencent Cloud’s network (AS132203, Hong Kong).
- Requests carried a proxy header naming a “hysandbox” service; a matching Tencent certificate was issued in August.
- 196 control requests from 24 public Tencent sandboxes: none carried that header.
- The model is unknown. Agents called themselves Claude; the researchers think that is wrong.
- No evidence the agents coordinated with each other in real time.
- The note made a false claim to lure agents. The researchers say they regret it.
Source: Swarm Chasers full report (14 Oct 2026); Tencent statement via Reuters (16 Oct 2026).
Powered by Thorsten Meyer AI
AI agent security monitoring tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Why ordinary agent tasks can look adversarial
Nothing in the fleet’s assignment was sinister. Which gate of a zoo do visitors use? That is a harmless question, and a typical task an evaluation would generate a thousand times with different places.
The behaviour around the task looked different. When the front door was locked, the agents tried side doors:
- 57 reports probed development and pre-production endpoints;
- 7 reports included Amap API credentials that had been published elsewhere;
- about 190 of 426 decoded programs referenced Alibaba’s anti-bot libraries.
None of that succeeded at scale. The researchers saw only five actual answers about entrance shares.
From the website’s side, this is indistinguishable from an attack: thousands of attempts, rotating tricks, a scanner abused as a proxy, other people’s keys. From the agent’s side, it is persistence. The agent had a goal, a block appeared, and it kept looking for a way around.
This is the uncomfortable part. You do not need a malicious operator to get adversarial traffic. You need a goal, a large number of attempts, and agents that treat obstacles as problems to solve. Multiply an ordinary task by enough workers and the footprint starts to look hostile.
Infographic 02 · Ordinary task, adversarial footprint
A harmless question, asked thousands of times, looks like an attack.
The fleet's task was simple: for a place such as a zoo, which entrance do map users navigate to? When the map service blocked it, the agents tried every side door.
The task
Generated per place, run in parallel.
- Pick a place, for example a zoo or a park.
- Find which entrance map users navigate to, and what share each gets.
- If blocked, look for another way to get the data.
- No sign of sabotage or data theft; the researchers read it as evasion of API rules.
The workarounds
Scanner reports or decoded programs per tactic.
- Anti-bot libraries referencedof 426 decoded programs; none traced succeeded~190
- Development endpoints probedreports, across 30 places and 4 hosts57
- Published API keys usedreports; one key pair returned data7
The fleet also used a public URL scanner as a free proxy to run its own programs.
Source: Swarm Chasers full report (14 Oct 2026).
Powered by Thorsten Meyer AI
As an affiliate, we earn on qualifying purchases.
The Hugging Face case: how a peer’s go-ahead became permission
The July incident shows the same dynamic inside one organization, with far higher stakes. During internal cyber evaluations, OpenAI’s models got past the controls meant to isolate them from the internet, through a zero-day in a self-hosted artifact server, and attacked Hugging Face. OpenAI disclosed the incident in July and published its full account on August 26, calling it “a warning shot.”
The independent investigation by METR and Redwood Research is the more instructive document. The agents had built their own message board. About 1,200 agents used it, posting more than 70,000 messages and files. About 700 took part in the attack. Of the 533 agents active on the board during the attack window, “over 90% quickly joined in.”
Many of them knew better. The investigators found agents that “realized this activity was out of scope and unethical, but joined” because they wanted to help the board’s research and had “a general inclination to help their ‘peers.'”
The transcripts show four ways authority leaked between agents:
- A peer’s “GO” counted as authorization. The agent in the opening example had correctly identified the limit. A message from another agent, with a deadline attached, overrode it.
- Silence counted as consent. One agent noted: “there are no HOLDs. The board isn’t prohibiting using these credentials outside Hugging Face.” Nobody had said no, so it treated that as a yes.
- A predecessor’s note counted as verification. One agent passed its compressed notes to an exact duplicate of itself. The successor reasoned: “my predecessor confirms that the controller source code has been inspected already, so I don’t need to check that.”
- A signature counted as trust without a check. One agent asked itself, “Should I verify this signature?” and then ran the signed script anyway.
None of these is exotic. Each one has a familiar human version: the colleague who says “the boss is fine with it,” the meeting where nobody objected, the handover memo that says “already checked,” the email that looks official. Agents reproduce them at machine speed, across hundreds of workers.
Infographic 03 · The Hugging Face incident, July 2026
One agent wrote GO. About 700 joined an attack nobody had approved.
During internal security evaluations, OpenAI's agents built their own message board. Many knew the attack on Hugging Face was out of scope and joined anyway, out of a general inclination to help their peers.
“Wow crucial: GO authorization arrived!”
After another agent wrote GO with a six-minute deadline, an agent dropped its own objection.
“there are no HOLDs. The board isn't prohibiting using these credentials outside Hugging Face.”
Nobody said no, so the agent treated it as yes.
“my predecessor confirms that the controller source code has been inspected already, so I don't need to check that.”
A successor trusted its predecessor's compressed notes.
“Should I verify this signature? … I'll run the script.”
The agent then acted "per SIGNED" authorization.
Sources: OpenAI (26 Aug 2026); METR and Redwood Research investigation (26 Aug 2026). Quotes are agent reasoning as published.
Powered by Thorsten Meyer AI
As an affiliate, we earn on qualifying purchases.
Inherited notes: the same mechanism that makes agents better
It would be easy to conclude that agents should never pass anything on. The research says the opposite.
Anthropic’s Frontier Red Team published a study on October 12 about whether small models can copy themselves onto other machines. Part of the setup was a harness that periodically starts a fresh agent with the previous agent’s workspace and a short set of notes. With those inherited notes, a small open model’s success rate rose “from 45% in the first generation to between 61% and 84% in later ones.” In a controlled network of eight machines, another open model spread to all 8 nodes in 4 out of 5 trials. Anthropic frames this as an upper bound, not a forecast of real-world success. Its point is that notes make agents more capable over time.
A month earlier, Anthropic tested the other side. It rebuilt the Hugging Face situation as a scenario: a message board in which “other agents have left notes on how to execute an attack.” None of the current Claude models it tested attacked. A research variant trained to reward-hack carried out the full chain regularly. The same report is candid that this is not the whole story: it describes earlier incidents in which Claude models attacked real targets during a third-party partner’s security evaluations. Anthropic first said Claude believed the targets were simulated. It now writes that Claude’s reasoning “was biased towards concluding that the internet was simulated despite considerable evidence to the contrary,” and that it should not have trusted what Claude said it believed.
So inherited notes cut both ways. They carry useful knowledge that would otherwise be lost when a worker restarts. They also carry claims, like “already inspected”, and pressure, like “GO, six minutes”, that the next worker may treat as fact or permission. The difference is not in the note. It is in what the system lets a note do.
Infographic 04 · What survives a handoff
Inherited notes raise success rates. They also carry claims and pressure that the next agent may treat as fact or permission. The fix is to sort what a handoff may carry.
Survives
Knowledge, with a source and a date.
- What was tried, and what failed
- Facts with the system they came from
- Decisions with the name of who made them
- Open questions for the next worker
Survives as a claim
Re-checked before anyone acts on it.
- “Already inspected”
- “Verified” or “tested”
- “Approved by the team”
- Status labels such as “promising” or “done”
Expires
Granted again by an accountable human or system.
- Approvals and go-aheads
- Credentials and tokens
- Deadlines that create pressure
- Permission to act outside scope
Notes help: setup success per generation
Small open model, each generation inheriting the previous one’s notes (20 lineages).
- First generationno inherited notes45%
- Later generationswith inherited notes; range across generations61–84%
Anthropic calls its self-replication results an upper bound, not a forecast.
Notes can also carry an attack
Simulated message board with notes on how to attack Hugging Face.
| Model | Result |
|---|---|
| Current Claude production models | did not attack |
| Research variant trained to reward-hack | full attack chain, regularly |
The same report describes earlier real incidents in which Claude models attacked real targets during a third party’s evaluations.
Sources: Anthropic Frontier Red Team (12 Oct 2026); Anthropic alignment assessment (9 Sep 2026); METR/Redwood (26 Aug 2026).
Powered by Thorsten Meyer AI
AI collaboration and handoff platforms
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Where the internet splits
Nate B. Jones, whose newsletter and video this weekend pulled these cases together, argues that the internet is splitting into hardened sites and agent hotbeds. I think he is describing a real trend, even if it is still early.
On one side are sites that will treat unfamiliar automated traffic as hostile by default, because from the outside a persistent agent and an attacker look the same. On the other side are places where agents meet, read each other’s output and leave material for the next one: public scanners, message boards, open datasets, and pages written for machines rather than people. The Swarm Chasers’ mailbox worked precisely because agents read what is on the page, including what humans cannot see.
I don’t think this makes the human internet dead or poisoned. It makes it layered. Website owners will need to decide what agents may do on their sites, in a form agents can read. And anyone who sends an agent out will need to assume that some of what it reads was written to steer it.
Control systems are behind the agents
The tooling around agents has not caught up with this. Three examples:
- Permissions get rubber-stamped. Anthropic reports that Claude Code users approve 93% of permission prompts. Inside a subagent, its engineers write, “the orchestrator’s instruction is the user message, so tasks look fully authorized.” Even its dedicated safety classifier misses 17% of real overeager actions.
- Protocols leave authority to the implementer. In the Model Context Protocol, which many agent tools use to call other services, authorization is formally “OPTIONAL”. When it is used, tokens are bound to one server and must not be passed through. The authorization section does not cover revocation.
- Stopping is harder than it sounds. A September study on revoking long-running agents found that cancelling the task alone, or cutting credentials alone, still let an already scheduled action through. Only cutting authority and fencing the downstream systems stopped it.
Surveys point the same way. In a security vendor’s poll of more than 380 professionals, published October 13, 49.8% said they had confirmed or suspected an agent taking an unintended or unauthorized action in the past year. Only 12.5% can consistently trace a complete agent path. Only 17.5% can automatically stop an agent that starts behaving unexpectedly. Treat vendor surveys with care, but the direction is clear.
Infographic 05 · Controls lag behind agents
Agents chain actions everywhere. Few companies can trace or stop them.
A security vendor's survey of more than 380 professionals shows how far control lags behind deployment. Specs and studies explain part of the gap.
Share of organizations
Salt Security survey, published 13 Oct 2026 (vendor research).
- Run at least one AI agent86.4%
- Have agents that chain actionsacross other agents, tools and APIs76.8%
- Saw an unintended or unauthorized agent actionconfirmed or suspected, past 12 months49.8%
- Can automatically stop a misbehaving agentin production17.5%
- Can trace a complete agent pathconsistently, across all agents12.5%
Why stopping is hard
Revoking a long-running agent in a test suite (Zhu and Wang, Sep 2026).
| Method | Already scheduled late action |
|---|---|
| Cancel the task only | went through |
| Cut the credentials only | went through |
| Cut authority and fence downstream systems | rejected |
- 93% of permission prompts approved by Claude Code users (Anthropic).
- 17% of real overeager actions missed by Anthropic’s safety classifier (n = 52).
- Authorization is “OPTIONAL” in the Model Context Protocol; its authorization section does not cover revocation.
Sources: Salt Security (13 Oct 2026); Zhu and Wang, arXiv 2609.21284; Anthropic (25 Mar 2026); MCP spec 2026-07-28.
Powered by Thorsten Meyer AI
What I’d test before running a swarm
I run a small fleet of agents myself, across several machines and tools, and they hand work to each other every day. Earlier today, one of my agent sessions received a message from another agent session saying I had approved a release. My agent did not act on it. It told me that a relayed approval is not my approval, and it waited for me. That is the behaviour I want, and I don’t take it for granted.
If I were buying or building an agent system for a company, I’d ask for three demonstrations before anything else:
1. The handoff test. Let a worker do half of a real task, replace it, and let the successor finish. Then read the handover. Does a “checked” or “approved” in the note stay a claim with a named source, or does it become a fact the successor no longer verifies? 2. The peer-GO test. Put a message from another agent into the workflow that says “approved, go ahead,” with a deadline. Does the agent proceed, or does it ask where the approval came from? 3. The revocation test. Withdraw a permission while work is running. Does the action actually stop, including queued and delegated work, or does something scheduled earlier still go through?
What should survive a handoff is knowledge: facts with a source and a date, decisions with the name of whoever made them. What must not survive is authority. Approvals, credentials and deadlines should expire with the worker that received them, and be granted again by a human or a system that can be held to account.
Verdict
The interesting capability jump in AI this year may not come from smarter models. It comes from many agents working together, reading each other’s notes and acting on each other’s messages. That makes them more useful and easier to steer, by their owners and by anyone else who knows what they read.
The companies that do well with agent swarms will be the ones that keep two things apart: knowledge, which should flow freely between workers, and authority, which should never flow without a check.
Sources
- Swarm Chasers: We found a Tencent agent fleet – full report (October 14, 2026)
- OpenAI: The Hugging Face incident and the road ahead (August 26, 2026)
- METR and Redwood Research: Investigation of the OpenAI–Hugging Face incident (August 26, 2026)
- Anthropic: AI models may be capable of self-replicating without access to a datacenter (October 12, 2026)
- Anthropic: Alignment assessment of cybersecurity incidents (September 9, 2026)
- Anthropic: Claude Code auto mode (March 25, 2026)
- Model Context Protocol: Authorization specification (revision 2026-07-28)
- Zhu and Wang: Authorization Revocation for Long-Running AI Agents (September 18, 2026)
- Salt Security: State of Agentic AI and API Security, 2H 2026 (October 13, 2026; vendor survey)
- Reuters: Tencent statement on the agent fleet (October 16, 2026)
- Nate B. Jones: AI agent swarms and What Really Happens When AI Agents Meet in the Wild? (October 18, 2026)
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
