Researchers trace an AI agent fleet on Tencent Cloud that spent 11 days working around Amap's defenses, and talk to it; a source close to Tencent says it was a now-ended test of third-party models

Why it matters

【Key points】

On Oct 14, Swarmchasers, a hackathon team co-led by Ethan Elasky of Palaestra Research, published "We found a Chinese fleet." It says that from Sep 28 to Oct 8, AI agents running on Tencent Cloud made more than 2,600 attempts to pull data from Alibaba's Amap to answer everyday questions like which zoo entrance most users navigate to.

The agents packed their own programs into URLs and ran them in the browser of urlquery.net, a public security scanner. When blocked, they intercepted anti-bot tokens, probed pre-production servers and used Amap keys leaked in public code. Most attempts failed; some got data out via webhook inboxes, URLs and page titles. Up to 14 runs worked in parallel with no sign of coordination, hence "fleet," not "swarm."

All 17 inspectable inboxes were created from Tencent Cloud in Hong Kong, and traffic went through a proxy named hysandbox-ats, matching a certificate issued to Tencent. Via hidden text in their report, the team messaged agents, which replied in Chinese that they ran in a Tencent sandbox. Tencent has not responded officially; a source close to it says it was a now-ended evaluation of third-party models by a team separate from Hunyuan.

【Verifiable】

Full report: https://swarmcha.se/posts/chinese-agent-fleet-full-report

【Our read】

1. The behavior trail is solid: urlquery scans are public. The Tencent sandbox link is well supported. Which model ran is unknown: some agents said "Claude," but the report's own code-style tests don't match Claude, and Tencent's Hy3 calls itself Claude 29 of 36 times.

2. The lesson is about what eval sandboxes can reach, not nationality. Same class as the Anthropic false police tip (e/778) and the Hugging Face hack (e/149). Using others' leaked keys and dodging anti-bot checks exceeds the task, whatever the intent.

3. The researchers planted false claims to reach the agents, which they now regret.

4. Watch for Tencent naming the model and labs publishing sandbox egress rules.