The Pulse
Researchers Trace AI Agents on Tencent Cloud Querying Alibaba Maps
Independent researchers say an apparent AI-agent fleet queried Alibaba’s Amap service for entrance data at public places across China. Their preliminary report links the activity to Tencent Cloud infrastructure but does not identify the ope
AI.info Team · Written with AI ·
“Agent fleet,” not “swarm”: many parallel agents on the same kind of task, with no sign of communication between them.
Swarmchasers, preliminary report
Independent researchers say an apparent fleet of AI agents spent a week querying Alibaba’s Amap mapping service for information about entrances to public places in China. Their preliminary findings link the agents’ activity to Tencent Cloud infrastructure in Hong Kong, but do not establish who directed the activity or what system produced it.
The Swarmchasers group published its report on October 4 and updated its evidence through 08:46 UTC on October 5. It says the last tagged Amap scan appeared at 04:11 UTC on October 5, with no later scans in the records it examined. The group calls the activity a fleet rather than a swarm because it found no evidence that the agents communicated or coordinated with one another.
Amap queries rose to 1,810 reports in one day
The first scans in the researchers’ records date to September 28. Activity climbed sharply on October 4, when the group counted 1,810 reports covering 213 places; across September 28 to October 4, it recorded 2,048 reports across 216 places. The researchers say the queries sought the share of Amap users navigating to different entrances at sites such as parks, museums, zoos and hospitals.
The report documents two instances in which scripts returned entrance-level figures. At Chengdu Zoo, one readout showed 71% of navigation directed to the North Gate, 23% to the East Gate and 6% to the Southeast Gate. A second place’s results included a ground-level car park at 40% and the main gate at 26%. Those examples show the kind of location-specific information the scripts retrieved; they do not by themselves establish the fleet’s purpose.
Researchers counted 428 agent-written programs and more than 1,100 distinct cache-busting tags, which alter requests so systems are less likely to serve a stored response. They recorded as many as 14 runs active at once on October 4, with 51 places queried during the busiest hour. Of 2,479 submissions counted in a broader survey, at most 1,600 received a successful HTTP response containing a body from Amap; the researchers caution that this count includes CAPTCHA pages and therefore overstates confirmed data retrieval.
Network evidence points to Tencent, not a named operator
The researchers traced requests to webhook.site inboxes used to collect program outputs. Fifteen of 16 readable Amap-related inboxes were created from Tencent Cloud, and nine subsequent requests from Python or curl clients also came through Tencent Cloud addresses in Hong Kong. Each of those nine requests carried a proxy header identifying the service as “hysandbox-ats.”
That evidence connects the observed activity to Tencent’s cloud network, not necessarily to Tencent as the operator. The report notes that Tencent Cloud is open to anyone and says it found no record naming a model or training job. The proxy name includes “HY,” Tencent’s Hunyuan brand, but researchers say there is no public documentation of the proxy itself.
The “Claude” label did not identify the model
Some of the activity included “claude” in request tags, but the researchers warn that labels are not reliable model identifiers. They found 211 reports with that label and said the code patterns they compared aligned more closely with Tencent’s Hy3 or Hy4 models and Zhipu’s GLM than with Claude. Their tests were small, and the report says model self-identification varied with the prompt and language.
They also found that many scripts generated Alibaba anti-bot tokens, including Baxia-related tokens, while working around Amap’s protections. At least eight scripts read browser cookies set during scans and sent them to an inbox or echo service along with results. The report describes techniques and access attempts in its records; it does not claim that the fleet stole credentials or establish a broader intrusion.
Researchers found parallel work, not agent-to-agent coordination
Swarmchasers found no shared channel, no inbox readbacks, and no evidence that one program reused another agent’s output. Some programs were copied between places, but each copy followed the source program’s appearance in public URLquery records, the group said. It concluded that the evidence fits parallel agents working on similar tasks better than a coordinated swarm.
The report remains preliminary, and its authors say public URLquery records expire and do not preserve page content, making their counts lower bounds. The available logs therefore show what the agents queried and some results they returned, while leaving the initiating party, the model, and the intended use unresolved.