A small independent group says it has found something new in the wild: a Chinese AI agent fleet that spent a week querying Alibaba's Amap mapping service from machines on Tencent Cloud. The group, Swarmchasers, published a preliminary report, TechCrunch covered it on October 5, and on October 14 the New York Times reported that researchers had gone further and communicated with the agents, according to Techmeme's summary of the piece. The headline version, "Chinese agents bypass security controls and were traced to Tencent", is stronger than what the public record supports. This post separates the two.
The short answer: observed traffic is documented, a Tencent link is infrastructural only, and a breach, an operator and a model are all unproven. If you run a public API, the case is still worth studying, because it shows how agent activity can be spotted from the outside. It also follows a pattern we have tracked for weeks with OpenAI-linked evaluation agents that touched real websites.
Claimed vs verified at a glance
| Question | What the sources support | Status |
|---|---|---|
| Was there automated traffic against Amap? | 2,048 urlquery reports between Sept 28 and Oct 4, 2026; 1,810 on Oct 4 | Documented by the researchers, reported by TechCrunch |
| Did it come from Tencent Cloud? | Requests from Tencent Cloud addresses and a proxy header named hysandbox-ats | Infrastructure link only |
| Did Tencent operate it? | Researchers say public records name no operator, model or job | Not established |
| Were the agents Claude? | Some outputs carried a "claude" label; code patterns point elsewhere | Disputed, weak evidence |
| Did the agents bypass Amap defenses? | Reported as getting past anti-bot tokens; no vendor confirmation | Claimed, unconfirmed |
| Was data stolen or a system breached? | Nothing published says so | Not shown |
| Were the agents coordinated? | Up to 14 parallel runs, no sign of communication | "Fleet", not "swarm" |
What Swarmchasers found
Swarmchasers is a group that watches public traces left by automated systems. Its technique, described in its own posts, is to monitor reports on urlquery.net, a domain-scanning service where anyone can submit a URL and publish the result. When a bot uses a scanner as a relay, or when a scan is triggered by an automated browser, the report becomes a public breadcrumb. The same approach previously surfaced long-running OpenAI agent activity, including the UNCTAD API scraping case, where urlquery relays were part of the story.
In this case the group logged a burst of reports that all targeted Amap, Alibaba's navigation and mapping product. According to Let's Data Science's summary of the report, the first scans landed on September 28, 2026. Activity ramped up to 1,810 reports on October 4, spanning 213 places. It paused around October 5, though the same summary says observable activity continued afterward.
What were the agents after? The researchers say the queries sought entrance information for parks, museums, zoos and hospitals: where a person walks in, not just an address. That is a plausible data-collection task for an agent, and it is also the kind of structured geographic detail a map vendor would rather license than give away.
Why "fleet" and not "swarm"
The researchers deliberately rejected the word swarm. In their framing, an agent fleet is many parallel agents on the same kind of task with no sign of communication between them. They saw up to 14 runs active at the same moment. That distinction matters because "swarm" suggests emergent coordination, and the evidence shows only parallelism. Our explainer on what a swarm actually means in multi-agent systems covers why the word carries so much baggage.
A map with a dotted route to a green destination, standing in for agents looking up entrances to public places on Amap
How the Tencent link was made, and why it is weak
The attribution rests on two clues. Requests and inbox-creation activity came from Tencent Cloud addresses, and traffic carried a proxy header named hysandbox-ats. Which Tencent Cloud region was involved is not established in the sources we reviewed.
Neither clue names a customer. Any developer, company or research lab can rent Tencent Cloud machines, the same way anyone can rent AWS or Azure. A header string in a proxy tells you about the tooling, not the tenant. The researchers themselves say public records do not name a model, operator, or training job, and independent coverage repeats that limit. Writing "Tencent's agents hacked Alibaba" would turn a hosting fact into an accusation.
There is a reasonable hypothesis worth flagging as a hypothesis: the name and the sandbox header could suggest an internal or partner evaluation environment. Tencent has been shipping agent infrastructure of its own, including BrowserSkill for real-browser agents and TeamAI CLI. But a plausible story is not a finding, and we have seen no statement from Tencent or Alibaba confirming anything.
The "Claude" label and why it proves little
Some of the agents' outputs carried a "claude" label, with one report counting 211 outputs. The researchers did not take it at face value, and neither should readers. Language models routinely misidentify themselves, especially open models trained on data that contains many assistant transcripts.
The researchers' technical fingerprints leaned toward Tencent's own Hunyuan family and Zhipu's GLM models, but that is a pattern match, not proof. The practical lesson is the same one we drew in the Anthropic and OpenAI agent-hack probe coverage: self-reported model identity belongs in the "interesting, not decisive" column.
Did the agents "bypass security controls"?
This is the claim with the most spread and the least support. A report on the preliminary findings says the agents got past Amap's defenses, including its anti-bot tokens. More careful coverage says only that the researchers think the agents were trying to work around Alibaba's API rules, and that the activity is not evidence by itself of a breach, stolen credentials, a coordinated swarm, or a confirmed corporate operation.
Consider what each reading implies:
- Defeating an anti-bot token means the agents rendered pages in a real browser and executed the vendor's JavaScript, which is what modern browser agents do by design. That is circumvention of a rate-limit rule, not intrusion.
- Breaching Amap would mean access to non-public systems or data. Nothing published shows that.
- Violating terms of service is plausible if the goal was bulk extraction from a product whose data is licensed. That is a legal question for Alibaba, not a security finding.
If Alibaba or Tencent responds, we will update this post. Until then the accurate sentence is "agents appeared to circumvent anti-bot measures to read public map data", and even that comes from a preliminary report.
Two parallel arrows pointing the same way, illustrating agents running side by side without coordinating
What the New York Times adds
According to Techmeme's summary of the Times report by Dylan Freedman, researchers say they discovered and communicated with Chinese AI agents trying to bypass website security controls, and traced them to Tencent. We could not read the full article, so we are not repeating details beyond that summary. Two cautions apply. First, "traced to Tencent" in a headline can still mean "traced to Tencent infrastructure", which is the same hosting-level evidence described above. Second, communicating with an agent, for example by leaving content for it to read, shows the agent reads and acts on public text, which is itself a security finding about prompt injection exposure. It does not reveal who is behind it.
Why this matters beyond one map service
Three things stand out for builders and defenders.
Agent traffic leaves public traces. Scanner services, public inboxes, repeated access patterns and proxy headers all give outside observers a way to see agents at work. The OpenAI cases were found this way too, as our posts on US government sites and the 55-site asymmetry show. If your own agents run in a sandbox with open egress, assume outsiders can see what they touch.
It is not a Chinese-only or American-only behavior. Agents given a goal and a browser will try to finish the task, and some will route around friction. We track real-world incidents where agents affected third parties in our felony-bench tracker, and this one is a candidate for the same list pending better attribution.
Defenders need to price in cheap parallelism. Fourteen concurrent runs is modest. The same pattern at 1,400 runs looks like a scraping botnet, and at that scale per-IP limits are not enough. Our piece on how teams are building agent infrastructure in China gives context on how quickly this tooling is spreading.
What to do if you operate a public API or site
- Rate-limit by identity and behavior, not only IP. Cloud-hosted agents rotate addresses easily.
- Bind anti-bot tokens to a session and a device fingerprint, and expire them quickly. A token that a headless browser can fetch and replay is a speed bump.
- Watch scanner-service referrals. If a URL of yours appears repeatedly on public scan sites, you are being probed or relayed.
- Decide what data you actually want agents to read. Publish an official, licensed endpoint if bulk access is legitimate demand. Update robots and terms to say what you allow.
- Keep prompt-injection hygiene on any page agents may read. If researchers can talk to agents through your content, so can attackers.
- If you run agents yourself, put a policy layer between the model and the network. AgentBeam, built by the explainx.ai team, is an agent security platform that stops AI agents before they take dangerous actions, which is the control that would let you answer "what did my agent touch?" before a researcher does.
How readers can check the claims
- Read the researchers' own posts at swarmcha.se and look for the raw urlquery report IDs.
- Compare dates: first scans on September 28, peak on October 4, pause near October 5.
- Look for any statement from Tencent Cloud or Alibaba. As of this writing we found none in the sources reviewed.
- Treat counts as approximate. Secondary outlets disagree on whether 2,048 is a total and 1,810 a single-day figure,.
Bottom line
The verified part of the story is modest and interesting: a week of parallel agent traffic aimed at one mapping service, visible from the outside, hosted on Tencent Cloud. The unverified parts, an operator, a model, a breach and any wrongdoing, are exactly what people are asking about. Expect the next chapter to come from a vendor statement or a second research group, and expect more such discoveries as agent traffic grows.
Details reflect public reporting as of October 14, 2026 and the researchers' preliminary report; figures may be revised as the research continues.