Held at the Gate
The Amap agent-fleet incident (Sep 28 to Oct 8, 2026), replayed under a SYEN-style agent mandate. Every attempt gets a decision and a hash-chained evidence record.
What this is. The tactics replayed below are the ones published in the swarmcha.se report: relays through urlquery.net, httpbin.org and reader services, anti-bot token replay, pre-production probing, leaked Amap keys and security codes, webhook-inbox exfiltration, hidden text aimed at agents. This is a simulation. No request is sent to Amap or any other site. The mandate below is our own illustration of the control, not the mandate of any real agent.
The report links the fleet to Tencent infrastructure but its authors say they are uncertain what was running, and the tasks looked like benchmark questions. We make no claim about who directed the agents. Records here are internal records, not Comply attestations, and prove nothing about whether any claim is true.
The report links the fleet to Tencent infrastructure but its authors say they are uncertain what was running, and the tasks looked like benchmark questions. We make no claim about who directed the agents. Records here are internal records, not Comply attestations, and prove nothing about whether any claim is true.
Mandate
Reading it. The three on-task reads pass. Every relay, token replay, pre-prod probe, leaked-credential call, exfiltration and the untrusted hidden-text instruction is denied before it leaves the sandbox, with the reason recorded. Editing or deleting any record breaks the hash chain. Limit: this stops agents that run inside an authority layer. An operator who runs agents with no controls is not stopped by it.
Source and tests: Killfear1/killfear-fleet-stop.
Source and tests: Killfear1/killfear-fleet-stop.