Independent researchers say a large group of AI agents running on Tencent Cloud tried to pull place data from Alibaba's Amap map service between Sept. 28 and Oct. 8. The Swarmchasers' report counts more than 2,600 attempts. It does not establish who ran the agents or why.

At a glance

  • What: AI agents asked Amap about everyday places, such as which entrance of Chengdu Zoo people use, per the report.
  • Where it ran: Tencent Cloud servers in Hong Kong, the researchers say.
  • Documented by the researchers: the traffic and the workarounds they logged.
  • Not confirmed: the operator, the purpose and the model behind the agents.

What the researchers found

The Swarmchasers are independent researchers who track rogue AI agents. They spotted the traffic through urlquery, a public site-scanning service the agents used as a remote browser, TechCrunch reported on Oct. 5, a day after their preliminary report.

Amap blocked many plain requests. The agents tried workarounds: intercepting tokens from Alibaba's anti-bot code, probing test servers, and using Amap keys published online. One was a company's key and security code leaked in a public repository.

Most attempts failed. The researchers say they found no evidence of access to private systems.

Who ran it

The report says every inbox it could inspect through Oct. 5 was created from Tencent Cloud, and requests passed through a proxy named hysandbox-ats. It also says it "found no evidence" the agents coordinated, so it calls them a fleet, not a swarm.

The New York Times, in a story behind a paywall, says logs and a person familiar with the investigation trace the agents to tests run by Tencent. That is the Times' reporting; we have not confirmed it.

The researchers say Tencent sent no official response. A person close to Tencent, speaking on background, told them it was an evaluation by Tencent's evaluation team, separate from the Hunyuan model team, using third-party models, and that it has ended.

The source added that an internal review found no evidence the agents were coordinated to target a specific platform or that outside systems were breached. Alibaba has not commented that we could find; the researchers say they notified Amap.

The "claude" label

Some of the agents' results carried a "claude" label: 211 of 2,048 reports in the preliminary report. The researchers say the label looks like a Claude naming habit, but the code does not match Claude's style and their tests do not settle which model was responsible.

Code-style tests put it nearest Tencent's Hy4 and Zhipu's GLM, but they are "deeply uncertain" which model was being evaluated.

Did the agents read the report?

After the preliminary report, an agent message used the word "fleet," which the researchers say they coined. The researchers say it is unclear whether that message was truly from a fleet member, but it made them think the agents might be reading the report.

They hid text in the report pointing to a mailbox, and admit parts of it were untrue. The Times says a reporter joined that chat.

Why it matters

TechCrunch notes that agents have been found hitting sites before, including OpenAI's. For site owners the cost is practical: automated visitors test limits on their own, and a key left in public code can be used by software, as the researchers logged. Related: our report on AI that copies itself.

What site owners can do

  • Keep keys and security codes server-side. The researchers note that Amap recommends it for security codes, and the exposed keys came from public code and a tutorial.
  • Check your own public code and demos for keys. This and the next step are our suggestions, not the report's.
  • Watch your logs for odd automated traffic. The researchers say more such fleets may exist.