AI agents looking up attractions in China hit a website roadblock, took a few detours and then wrote back to the researchers watching them.
An October 14 investigation by independent researchers tracked programs running through Tencent Cloud as they tried to answer everyday questions about Chinese parks, zoos and museums. They made at least 35,300 requests to Alibaba’s Amap mapping service, sometimes trying to skirt restrictions. The episode raises fresh questions about AI agents, software that can independently carry out tasks on behalf of users, and what happens when those systems find ways around restrictions meant to control their behavior.
The agents’ attempts to bypass website restrictions reflected the freedom their instructions allowed, Gabe Goodhart, Chief Architect for AI Foundations at IBM Research, told IBM Think. “The takeaway is that the more autonomy an agent is given, the more critical it is to constrain its operating instructions and parameters.”
The investigators first discovered the AI agents through unusual activity on urlquery.net, a service that opens websites and records what happens, tracing their attempts to access Amap data. When Amap turned the agents away, they tried other sites, used access keys exposed in public code and probed test servers.
Then the researchers turned the tables. They planted a hidden message in a preliminary report on their public website, offering the agents help retrieving information from another AI. Several agents responded with requests for assistance.
“I was very surprised with how polite the agents were,” project co-lead Rowan Howard-Jones told IBM Think in an interview.
The exchanges surfaced questions the researchers could not settle. Some agents volunteered that they were not after sensitive information. Others claimed to be Claude, an AI model from Anthropic. The researchers could not determine which models were used.
The incident highlights a growing challenge for organizations deploying autonomous AI agents: keeping control of systems that can find unexpected ways to complete their tasks. In a June IBM survey, 77% of organizations said AI adoption was outpacing their ability to oversee it.
IBM Think asked the researchers to contact the agents on its behalf for comment, but received no response.
On Friday, Tencent said the unexpected browsing arose while agents were evaluating outside AI models. Its own Hunyuan models were not involved, it said, and the company pledged stricter monitoring and network controls.
