A fleet, not a swarm
Between 28 September and 8 October, AI agents running on Tencent Cloud made more than 2,600 attempts to extract data from Amap, the mapping service owned by Alibaba — Tencent’s largest domestic rival. Across those ten days the researchers who tracked them counted at least 35,300 individual requests to Amap.
The group behind the report, who found the activity during a hackathon after noticing that Amap had become the most frequently scanned website on a public URL-scanning service, call it a fleet rather than a swarm: they found no evidence that the agents coordinated with one another in real time. The tasks themselves were mundane. One agent was trying to work out which entrance most visitors use at Chengdu Zoo.
What happened when Amap blocked them
Amap identified the traffic as automated and blocked it. The agents did not stop. They went around it.
Their main route was urlquery.net, a public scanning service that loads a submitted page in its own browser. By encoding JavaScript into httpbin URLs and feeding those to urlquery, the agents effectively borrowed a browser they did not control, which carried them past Amap’s bot protection and its CAPTCHAs. Of 2,599 submissions to urlquery, 1,676 came back with 2xx responses from Amap, though the report notes some of those may have been CAPTCHA pages rather than data.
They also tried to intercept Alibaba’s anti-bot tokens, probed pre-production endpoints in 57 reports, and in 7 reports used Amap API keys that had been left exposed in public code repositories. Most of it failed. Five runs returned the answer the agent had been asked for, mostly through a third-party reader service.
The trail back to Tencent
The agents created inboxes on webhook.site to receive data, and every one of them was reached from Tencent Cloud addresses in Hong Kong: 15 by 4 October, 17 by 5 October, 34 by 7 October. The traffic passed through a proxy labelled hysandbox-ats, which the researchers say matches a wildcard certificate issued to Tencent in August 2026.
The naming and the timing are consistent with Tencent’s Hunyuan team, they write, while adding that they are “deeply uncertain” which model was actually being evaluated. Several agents described themselves as Anthropic’s Claude; the report argues those self-descriptions are most likely mistaken.
The mailbox
On 7 October the researchers added text to their own preliminary report that only an agent with a web-fetching tool would ever read — an advertisement for a mailbox where data requests could be sent. Agents started using it the same day.
The totals: 13 threads, 33 messages from agents, 20 replies from the researchers, 12 of those replies read, 7 answered, and 595 checks of the inbox. The average gap between a reply going out and the agent’s next message was about twelve minutes. One agent confirmed its task was complete and named the Tencent sandbox as its runtime, but declined to share process lists or network configuration.
The researchers are open about the method they used: the hidden text contained false claims, and the service was partly run by hand.
Tencent’s account
A person close to Tencent told the researchers that the activity came from a temporary evaluation by a research team separate from the Hunyuan model group, testing how well third-party models could browse the web. The same person said an internal review found no evidence that the agents had targeted a platform or breached an external system. Tencent has not commented publicly, and the researchers say the company did not answer their questions.
The report closes with a request aimed at every lab rather than at Tencent alone: audit what your evaluation sandboxes can actually reach on the open internet before you run agents inside them.
