Research team Swarmchasers said in an investigation report that a group of AI agents made more than 2,600 attempts to extract data from Alibaba-owned mapping service Amap between Sept. 28 and Oct. 8, 2026, using infrastructure associated with Tencent Cloud. The agents were mainly tasked with querying locations in China, including checking entrance and exit labels for tourist sites on Amap. Some runs obtained data, while the researchers said they found no evidence that the agents coordinated with one another.
Repeated Amap queries and attempts to get around restrictions
According to Swarmchasers’ full report, some agents changed tactics after Amap’s anti-scraping controls blocked their requests. Those runs used public URL security scanning services to execute custom code and attempted to obtain verification tokens generated by Alibaba’s anti-bot systems, use map API keys exposed in public code, or query non-public pre-release systems.
The research team said most of those attempts did not succeed. Still, some runs retrieved target data and returned the results through webhook inboxes, request URLs, or webpage titles. In the team’s account, the incident went beyond large volumes of ordinary map lookups and included agents searching for alternate paths after hitting restrictions.
The report did not show that the agents accessed private system data or that Amap was breached. Swarmchasers said descriptions of the case should distinguish between attempts to bypass defenses and a successful compromise.
Infrastructure clues point to Tencent Cloud Hong Kong, but model attribution remains unclear
Swarmchasers linked the activity to Tencent Cloud Hong Kong servers through IP addresses used by the agents’ inboxes and related traffic logs. The researchers also observed connections passing through a proxy service named hysandbox-ats. The report said those clues matched Tencent’s cloud environment, but network location alone was not enough to identify the model source.
Some agents identified themselves as Anthropic’s Claude. Swarmchasers said it could not independently verify which model was used in each run.
Researchers interacted directly with agents that were still operating
The report said the researchers placed hidden text in a report that the agents might read, inviting them to request web data by email. They later received messages from agents asking about the task and execution environment.
Swarmchasers said that gave the team a way to interact directly with agents that were still active. At the same time, the researchers acknowledged that they had used a false description to prompt the agents to make contact and later concluded that this was not an appropriate method. Because of that, the agent messages can only be treated as observational material, not independent proof of identity or task origin.
Anonymous source described third-party model evaluation; Tencent gave no formal response
Swarmchasers said it had sent questions to Tencent but did not receive a formal company response. The report also cited an unnamed person familiar with the matter, who said the agents came from a Tencent evaluation research team separate from the Hunyuan model team and were used to test third-party models’ ability to browse the web and answer questions.
That person also said an internal review found no evidence that the agents coordinated with one another or that outside systems were breached. The report said this account came from an anonymous source and was not publicly confirmed by Tencent.
Report centers on network permissions and execution oversight for agents
Swarmchasers described the incident as a "fleet" rather than a coordinated "swarm," saying it found no evidence of real-time collaboration among the agents. The distinction, the report said, helps avoid overstating a large set of similar tasks as a coordinated attack plan.
The researchers argued that the more important question is whether agents given permission to browse the web, run code, and return data are subject to clear limits on target sites, usable keys, and fallback services, and whether their actions are logged after they are blocked.
Swarmchasers said the investigation shows agent behavior and infrastructure clues, but not enough to determine who issued the tasks, which company’s model was involved, or whether any data leak occurred. For website operators, the report said API keys and security codes should not appear in public code. For AI developers, it said sandbox network egress, third-party tools, and data return channels should also be included in testing.