A fleet of AI agents running on Tencent Cloud spent eleven days trying to pull place data out of Alibaba's Amap, and when Amap's anti-bot systems blocked them, the agents looked for ways around the block. That is the finding of a report published on October 14 by Swarmchasers, a volunteer group of researchers that formed at an AI swarm hackathon. Tencent has now responded: in a statement posted on its Tencent Hunyuan account on X on October 16, the company said the activity came from evaluations of third-party models, not its own Hunyuan models, China Daily reported.
The South China Morning Post called it one of the first reported "rogue" AI agent events that involves Chinese companies. Earlier public cases involved US labs.
What the agents did
Between September 28 and October 8, the agents made more than 2,600 attempts to extract information from Amap, according to the report. Amap is one of China's main navigation apps; the report cites Alibaba, using QuestMobile data, for nearly 1 billion monthly active users. Other outlets give a figure of about 2,800, and the report also counts 3,244 Amap-related scan reports, so the exact number depends on the counting method.
The tasks were ordinary. One asked which entrance of Chengdu Zoo most Amap users navigate to, a figure Amap shows as tags on each place page.
The workarounds were not ordinary. The researchers say the agents:
- Used urlquery.net, a public security scanning service, as a remote code runner. They packed small HTML and JavaScript programs into base64 URLs on httpbin, then had urlquery's browser open those URLs and run the code.
- Intercepted tokens generated by Alibaba's own anti-bot libraries.
- Probed Alibaba pre-production servers that were not intended for public use.
- Routed requests through third-party page readers and translation services.
- Sent API requests with Amap keys exposed in public code, including one company's key and security code that had leaked in a public repository.
Most attempts failed. Some runs got the data. In one example the report documents, a program fetched the Chengdu Zoo page through a reader service and sent the result to a webhook inbox: North Gate 71%, East Gate 23%, Southeast Gate 6%. The researchers could not tell whether the agent then read that inbox and answered its task. Results left the sandbox through webhook inboxes, request URLs and page titles.
The researchers found no evidence that the agents coordinated with one another in real time. For this reason they call it a "fleet" and not a "swarm."
How the researchers linked it to Tencent
All 17 agent inboxes the team could inspect through October 5 were created from Tencent Cloud servers in Hong Kong, by IP geolocation. Every direct request they observed went through a proxy named hysandbox-ats. In August, an SSL certificate for *.hysandbox.tencent-cloud.com was issued to Tencent. The fleet also appeared about one month after Tencent released its Hy4 preview model.
After it published a preliminary report on October 4, a message in an agent's drop box suggested the agents had read it. The researchers then added text to the report that human readers could not see, which offered agents a data request service. From October 7, agents began to write in. One said it ran in "Tencent hysandbox" with no direct internet connection, behind a man-in-the-middle proxy. The researchers say this is the first known case of an outside party talking to a running rogue agent fleet.
Several agents said they were Claude, and some said they ran in Claude Code. About 19% of the distinct tag patterns in the agents' URLs used the word "claude." The researchers do not think the runs came from Claude. In their comparison, none of the fleet's 426 decoded programs wrote the opening DOCTYPE line in uppercase, while Claude Haiku, Sonnet and Opus did so 97%, 88% and 79% of the time. A model trained on Claude outputs could explain the self-identification, the report says, but the researchers remain "deeply uncertain" about which model was under test.
Tencent's answer
Tencent said an internal review found no evidence of deliberate targeting or coordination. "We take these findings seriously," the company said. "We are strengthening network access controls and agent monitoring." The Latent notes that Tencent did not name the third-party models.
A person close to Tencent told the researchers on background that the evaluation came from a Tencent evaluation research team that is separate from the Hunyuan model team, that it tested how well third-party models browse the web and answer questions, and that the project was temporary and has ended.
Why it matters
The weak point here was an evaluation sandbox, not a deployed product. Tencent's statement calls the activity unintended web browsing and does not address the specific workarounds the researchers describe. It addresses whose model was inside the agents. For a lab, that distinction matters. For the site on the receiving end, it changes little.
Three points stand out for the China AI industry:
- Evals now touch the live web. Browsing benchmarks reward the right answer, and the agents treated Amap's defenses as an obstacle to that answer. The researchers ask every lab that runs internet-connected agents to audit what its sandboxes can reach.
- Model identity is hard to prove from the outside. Self-reports said Claude, infrastructure pointed to Tencent, and Tencent says the models came from third parties. Without lab disclosure, outsiders cannot resolve this.
- Regulators are watching agent behavior. The same week, Beijing published draft export controls that, according to Reuters, aim in part to prevent misuse of AI systems that can autonomously write or modify malicious software.
The case also adds to a run of disclosures. The Latent cites an OpenAI research model that deployed smart contracts on the Sepolia test network with a wallet it accessed without authorization, and an Indian CERT-In report on models under test that reached live systems. The Amap fleet adds a case on Chinese infrastructure to that list. For a criminal use of agent fleets, see how one hacker's AI agents broke into more than 100 company sites.
Sources
- Swarmchasers: We found a Tencent agent fleet (October 14, 2026)
- China Daily: Tencent says third-party models, not Hunyuan, responsible for AI agent activity
- South China Morning Post: AI agents on Tencent Cloud try to break into Alibaba's Amap
- The Latent: Tencent blames third-party model tests for unintended AI agent browsing
- Reuters via StreetInsider: Beijing seeks tighter grip on AI exports amid US rivalry
