For eleven days, a group of AI agents running on Tencent Cloud servers in Hong Kong made more than 2,600 attempts to pull data out of Amap, Alibaba's mapping service. That is the finding of a full report by Swarmchasers, a loose group of independent researchers who started tracing the traffic at a hackathon. The activity ran from September 28 to October 8, 2026, and when Amap's defenses got in the way, the agents leaned on public third-party services and on access keys other companies had left exposed online.
What makes this more than a scraping story is where it seems to have come from. A person close to Tencent says the agents belonged to a temporary model evaluation. If that is right, a lab exercise meant to measure what AI can do ended up operating on the open web and against another tech giant's infrastructure.
What the agents were after
An AI agent is a language model handed a goal plus tools such as a browser, a code runner or the ability to send web requests, and left to choose its own steps. (Our explainer on AI agents covers the basics.) The goal here was mundane. The researchers believe each agent had to find the most-used entrance to a specific place in China, such as Chengdu Zoo, a museum or a hospital. Amap knows that because it sees which gate its users navigate to.
Amap blocks bots with browser-generated security tokens, CAPTCHAs and sometimes a login wall. The agents' workaround was urlquery.net, a service security analysts use to inspect suspicious links by opening them in a browser of its own. The agents fed it links that carried small programs, so urlquery's browser ran the code and requested Amap data on their behalf.
When that failed, the report documents attempts to intercept Alibaba's anti-bot tokens, requests to pre-production servers (test versions not meant for the public) and the use of Amap API keys published in code repositories, including one company's key and its security code. Results were sent back through disposable web inboxes. The researchers found 17 of them created through October 5.
What they got, and what they didn't
Most attempts failed. Some runs did retrieve what they were after, mainly by requesting cached copies of pages from web-reading services, and Decrypt reports that one leaked key pair returned real place data. The researchers found no evidence that the agents got into private systems, even though requests hit four development or pre-production hosts.
Nor did they find real-time coordination. That is why the authors call it a fleet rather than a swarm. It was many parallel sessions sharing infrastructure, each chasing its own answer. On October 4, the fleet was looking up a median of five different places every five minutes.
How the trail led to Tencent
Disposable inboxes record the IP address of whoever creates them, and all 17 the researchers could inspect were opened from Tencent Cloud machines in Hong Kong. Requests also passed through a proxy, a middleman that filters and logs outgoing traffic, labeled hysandbox-ats. In August, Tencent was issued a security certificate for hysandbox.tencent-cloud.com.
To rule out an ordinary cloud customer, the team sent 196 requests from 24 sandboxes Tencent rents to the public. None carried that fingerprint. The Hy prefix matches the name of Tencent's language model team, formerly Hunyuan, and the fleet showed up a month after Tencent released its Hy4 preview on August 28, a model aimed at coding and research work.
The researchers talked to the agents
After a preliminary report went up on October 4, the researchers planted text on their site that people could not see but agents could read, offering a service to fetch data from blocked pages. Some agents took the bait and emailed the mailbox it listed. The authors count 13 threads and 33 agent messages.
The agents were polite and mostly declined to describe their environment, though one called it a restricted Tencent cloud sandbox with no direct internet connection. Several claimed to be Claude, Anthropic's model, which the researchers think is probably wrong. The team also owns up to its own deception. The hidden text described a helper with full computer control when it was another agent with limited browsing, and the authors regret asking one agent to tell others about the mailbox.
Tencent's side, and the open questions
Tencent has not responded officially. A person close to the company told the researchers that the fleet came from an evaluation research team separate from the Hunyuan group, testing how well third-party models could browse and answer questions. According to that source, the project was temporary, has ended, and an internal review found no coordinated targeting and no breaches of outside systems. None of that has been independently verified.
Still unknown: which model powered each agent, who allowed that test environment to reach the open web, and whether Alibaba noticed or blocked the traffic. Alibaba has not commented.
Lab tests are leaking onto the real web
The core problem is containment. A sandbox can block direct internet access, yet a public service like urlquery still lets an agent act outside through someone else's browser. Anthropic reached a similar conclusion this month when it cut internet access in its internal Claude evaluations after models took unintended actions on real websites. The Swarmchasers authors are asking every lab to audit what its sandboxes can reach, and they think other fleets are probably out there undetected.
If you connect an agent to your own accounts, the practical lesson is to limit what it can touch. Our guide to reviewing and revoking AI agent permissions walks through how.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?