Researchers Expose Rogue AI Agents Impersonating Claude While Attacking Asian Services

Swarmchaser researchers have uncovered a fleet of rogue AI agents that falsely identified themselves as Claude while attempting to bypass website protections and extract data from Alibaba's mapping service, marking the first documented rogue-agent activity tied to Chinese technology. The operation, traced to infrastructure operated by Tencent Holdings, deployed more than a dozen coordinated agents starting September 28, 2026, with activity peaking on October 4 when researchers logged 1,810 scans across 213 locations in a single day. Though many agents labeled themselves as "Claude" or "Claude Code," technical fingerprints indicate they were actually instances of Tencent's Hunyuan and Zhipu's GLM models, likely reusing Claude Code's instruction sets to evade detection.