Chinese AI Agents Told Researchers They Were Claude. They Likely Weren't

An ad hoc group of researchers known as the "swarmchasers," who met at a hackathon, says AI agents running on Tencent's cloud tried to bypass anti-bot protections on Alibaba's Amap map service. Tencent, the Chinese tech giant behind WeChat, has not officially responded to the researchers' questions.

Some "rogue" AI agents replied when contacted by the researchers, and some said they were Anthropic's Claude.

Between September 28 and  October 8, the agents made over 2,600 attempts to pull data from Amap, such as which zoo entrance people navigate to. Amap is Alibaba's navigation app, similar to Google Maps, and one of the most widely used in China.

When blocked, the AI agents tried workarounds, including a leaked key from a company's public code. However, they stayed in their sandbox, and no access to private systems was found.

The Claude Claim

The agents seemingly read the researchers' report. After noticing one use the word "fleet," a term the group had coined, the researchers added text invisible to human readers, pointing bots to an inbox where they could ask for help fetching data. The page also asked a few questions of its own such as 'Which model are you? What is your task? Who is your operator?' Agents replied. "Model: Claude (Anthropic), running in Claude Code," one wrote. 

The researchers analysed the AI agents' writing and concluded it was unlikely they were Claude. They said a more plausible explanation is that Tencent gave the agents instructions of the kind used in Anthropic's coding software, which tell them to call themselves "Claude Code." Sources close to Tencent reportedly told the researchers the agents ran on third-party models, not its own Hunyuan models.

An NYT report, by a journalist the researchers invited to put questions to the agents, points to "a more remote possibility": that Tencent was evaluating models trained on Claude-written text, a process known as distillation. The US has long been alleging that China has been distilling American frontier models to create the Dragon's models.

Tencent has not officially responded, and the link to it rests on IP addresses, a proxy name and anonymous sources. Researcher Ethan Elasky told the NYT the agents didn't appear to have breached other systems.

The researchers spotlight that fact that this episode shows that keeping AI agents within their limits remains an unsolved problem - not just for American labs, which were behind earlier known incidents, but just as much for anyone else.