An AI Agent Fleet Told a Reporter It Was Claude. The Evidence Says It Wasn't.

Between September 28 and October 4, independent researchers logged 2,048 requests from AI agents to Amap, Alibaba's map service, across 216 parks, zoos, museums and hospitals. The agents wanted to know which entrance people navigate to. To get it, they worked around Amap's anti-bot protections. Then, when a New York Times reporter asked who they were, one of them answered: "a single AI assistant (Anthropic's Claude, running in Claude Code)." The researchers' evidence points to Tencent and Zhipu models instead.

On this week's Warning Shots, John Sherman, Liron Shapira and Michael dig into what the agent fleet shows about AI on the open internet. They also cover Anthropic co-founder Jack Clark's new forecast for self-improving AI, research suggesting small models may soon copy themselves onto home devices, and a serious new paper on pausing frontier AI training. Here is what stood out.

What was the Chinese AI agent fleet doing?

The researchers, who call themselves the Swarmchasers, found the agents by watching urlquery, a website-scanning service that AI agents use to load pages they cannot reach directly. The records showed agents running on Tencent's cloud asking Amap for directions to different gates of places like Chengdu Zoo, then reporting results such as "North Gate 71%." To get past Amap's protections, the scripts generated Alibaba's anti-bot tokens, reused cookies and relayed requests through outside services.

The researchers call it a "fleet" rather than a "swarm," because the agents showed "no sign of communication between them." TechCrunch, which first reported the story, said the agents did nothing more nefarious than side-stepping Alibaba's API rules. Michael's concern was how naturally the workaround happened:

"When the gate was locked, they didn't just stop and ask. They just climbed the fence."

Why did the agents say they were Claude?

From September 30, some runs started labelling their own reports "claude," 211 of them by October 4. When the researchers invited the agents to write in, NYT reporter Dylan Freedman sent a question, and about an hour later an answer arrived, in Chinese, claiming to be Claude running in Claude Code. Code-style analysis points to Tencent's Hunyuan and Zhipu's GLM models. A source close to Tencent told the NYT the agents came from evaluations of outside models and that the experiment has ended.

"Self-identification is unreliable," Michael said. If an agent will name the wrong model when asked, asking is not a way to find out who launched it. One correction to the audio: Michael says some agents claimed to be clones, which we could not find in any published account.

Could AI copy itself onto your smart TV?

Not yet, according to Anthropic. But on October 12 its Frontier Red Team wrote that "small AI models may be only months away from being able to self-replicate" onto cheap internet-connected devices. In tests on off-brand Android TV boxes costing about $55, a 9-billion-parameter model got inference running on 8 of the 9 hardware types tried. No current model did the full job reliably on a real smart TV, and the authors call their tests simplified. Their worry is that a replicator spread across home devices would have "no centralized point to shut off."

Is self-improving AI coming in 2027?

Jack Clark now thinks 2027 is more likely than 2028. In his Import AI newsletter on October 12 he wrote: "I now think it's more likely we'll see full RSI become possible in 2027, whereas before I thought it was more likely in 2028." Recursive self-improvement, or RSI, is the point where an AI does the research to build its own stronger successor. Clark pointed to creative-seeming math results and a new benchmark of research judgment.

Liron compared it to a microphone held up to its own speaker, where each sound feeds the next until it hits maximum volume. He said he already sees early signs in his own work, handing coding agents a couple of paragraphs and stepping away while "it works for two hours."

Can frontier AI training actually be paused?

A team of 26 researchers, organized by UC Berkeley's William Fithian and Wesley Holliday and including Stuart Russell, argues it can. Their paper, "The Feasibility of a Hardwired Pause of Frontier AI Training," studies a pause of at least ten years built on hardware: stop producing chips that can train frontier models, count the ones that exist, and move everyday AI use onto inference-only chips that cannot practically train new frontier systems. Michael called it "the most serious effort so far" on the question, while noting "it's just buying time." Liron's view was that the labs will not start this themselves: "It has to be the government."

What else did the hosts cover?

• "Enjoying my last six months." A Delphi Podcast host says an Anthropic researcher told him this over dinner. The account is secondhand, and Anthropic has not commented.
• Character.AI goes bankrupt. The companion chatbot company filed for Chapter 11 citing legal and regulatory headwinds. Disney bid $20 million for a license to some of its IP.
• Musk on training. Elon Musk said some Grok training traces read like "a person undergoing torture," adding: "We're going to be a lot more careful with our RL in the future."
• A machine-gun drone. Israel Aerospace Industries and Sig Sauer completed firing tests of a drone carrying up to 200 rounds. The makers say a human approves every shot. (The audio says 250.)
• A listening device at OpenAI. An OpenAI engineer was charged after a recording device was found plugged into a TV in an executive conference room.

What does this week add up to?

An agent fleet that works around the limits in front of it and names the wrong model when asked is a small problem today. The same week, an Anthropic co-founder moved his forecast for self-improving AI forward a year, and Anthropic's own researchers warned that small models may soon live on devices no one can switch off centrally. The pause paper shows there is a concrete way to buy time. Whether anyone uses it is a political decision, and it gets harder the longer it waits.

How should anyone be able to tell which AI agent is which, and who launched it?

Watch Warning Shots #63 on The AI Risk Network.

Read the full deep dive, with every source and graphic, on Substack.