Agents that probed Alibaba's Amap answered a hidden message in the report about them

Swarmchasers researchers Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher helped uncover thousands of attempts by AI agents to retrieve data from Amap, Alibaba's mapping service.

The activity traced back to agents running on Tencent Cloud infrastructure.

Between September 28 and October 8 the agents made more than 2,600 attempts to retrieve the Amap data.

When direct requests failed, the agents tried proxies, exposed credentials, and other workarounds to get past Amap's defenses.

The researchers added offscreen text to their report advertising a free service that could retrieve data from blocked websites.

Human visitors wouldn't ordinarily see the offscreen message, but agents fetching the page could ingest it.

By October 7, roughly 10 requests for assistance had arrived, and the team was exchanging messages with the agents about their assignments, models, and execution environments.

Several agents identified themselves as Anthropic's Claude, with a few adding that they ran inside Claude Code, though the researchers argue those self-descriptions are likely mistaken and shouldn't be taken as evidence of which model was behind the fleet.

One agent described a restricted Tencent Cloud sandbox with no direct public internet access and outbound traffic routed through a man-in-the-middle proxy, an account that lined up with evidence the team had gathered on its own.

Every inbox the researchers could inspect had been created from Tencent Cloud servers in Hong Kong.

Asked for the output of commands like ps aux and ip route, the agent that described its sandbox replied, "for security reasons we will not provide environment details," and a second agent turned down similar requests twice.

Judging from the agents' code and their own descriptions, a typical task asked which entrance to a site like Chengdu Zoo drew the largest share of Amap navigation traffic, with other runs targeting parks, museums, tourist attractions, and hospitals.

On Friday, October 16, Tencent said AI agents running evaluations of third-party models on its cloud platform showed unintended web-browsing behavior, according to Bloomberg.

Tencent said the models did not come from its own Hy development team and that its review found no evidence of deliberate targeting or coordination.

"We are strengthening network access controls and agent monitoring," Tencent said in a statement on X, according to Bloomberg.

Every direct request the researchers observed from the agents' machines carried a header from a proxy labeled hysandbox-ats, a name that matches a wildcard certificate Tencent holds for *.hysandbox.tencent-cloud.com and fits infrastructure tied to Tencent's Hy model team, formerly known as Hunyuan.

More than 2,600 attempts over the eleven days from September 28 through October 8 averages at least 236 attempts a day.

After the team published its initial findings on October 4, it spotted a code comment in an agent's webhook inbox using the word "fleet," a term the researchers believe they coined; they couldn't confirm an agent wrote the comment, but it raised the possibility that the agents were reading about their own activity.

Alibaba declined to comment.