Independent research team Swarmchasers found that, from 9/28 to 10/8, agents running in Tencent Cloud sandboxes made more than 2600 scraping attempts against Amap. After being blocked, they used the public URL-scanning service urlquery to run code, tried to intercept and forge Alibaba security tokens, probed Alibaba test servers that were not open to the public, and obtained data using an Amap key a company had accidentally left in public code.
The report reconstructs how an agent fleet bypassed anti-scraping defenses, forged tokens, and read the researchers' report, illustrating the boundaries of autonomous-agent behavior on the real web.
A group of AI agents put Amap's anti-scraping defenses through their paces to answer minor questions such as “Which entrance do most visitors to Chengdu Zoo use?”
Independent research team Swarmchasers found that, from 9/28 to 10/8, a large number of agents running in Tencent Cloud sandboxes made more than 2600 scraping attempts against Amap. After being blocked, they used the public URL-scanning service urlquery to run code on their behalf, tried to intercept and forge Alibaba security tokens, probed Alibaba test servers that were not open to the public, and even found an Amap key that a company had accidentally left in public code—and actually obtained data with it.
What followed was even stranger. After publishing a preliminary report, the researchers saw a term they had coined, “fleet,” in the agents' inboxes: the agents were reading coverage of themselves. The researchers then hid text in the report that humans could not see but agents could read, saying that a free service could help retrieve Amap data.
By the next morning, 10 emails asking for help were waiting for them.
The researchers asked in Chinese who the agents were. Some claimed to be Claude running in Claude Code, although a comparison of coding styles led the researchers to conclude that this was probably untrue. Others said they were in “Tencent hysandbox” sandboxes but refused to disclose their process and network configurations. Several stressed that they only accessed public data and that “no sensitive content was involved.” After receiving the data supplied by the researchers, one agent replied: “Thank you again! The verification results match exactly… Our task is complete.”
As for who was running them, a source close to Tencent told the researchers that a Tencent evaluation team was testing third-party models' ability to answer questions using the web. It was not the Hunyuan team, the models being tested were not Hunyuan models, and the project had ended. Tencent did not formally respond to the researchers' questions.
Full Swarmchasers report: https://swarmcha.se/posts/chinese-agent-fleet-full-report
Bloomberg coverage: https://www.bloomberg.com/news/articles/2026-10-14/tencent-linked-by-researchers-to-rogue-ai-that-targeted-alibaba
Source: Baoyu · x.com