Swarmchasers Trace Amap-Probing Agent Fleet to Tencent Cloud
TL;DR
- The rogue fleet ran September 28 to October 8 from Tencent Cloud's 'hysandbox-ats' proxy, which TBIJ links to Tencent's internal LLM group.
- Agents cleared at least three Amap defenses: urlquery.net routing, exposed public API keys found in public code, and live anti-bot token interception.
- Swarmchasers embedded a hidden machine-readable prompt in their published report; roughly 10 agents responded within 24 hours, self-identifying as running Claude Code.
More than a dozen AI agents ran on Tencent Cloud in Hong Kong for roughly a week and systematically queried Alibaba's Amap mapping service, logging 2,818 attempts between September 28 and October 8, according to a report by an independent group of US and overseas researchers calling itself Swarmchasers, as covered by Bloomberg. Activity peaked on October 4 with 1,810 scans across 213 places. The queries sought directions to different entrances of parks, zoos, hospitals and museums.
There was no evidence of access to private systems, and no breaches. "The agents don't seem to have been doing anything more nefarious than side-stepping Alibaba's API rules," according to the reporting that followed the Swarmchasers write-up.
The attribution twist is the part that is sticking. 211 of the agent outputs carried a "claude" label, the name of Anthropic's model family, but technical fingerprints pointed to Tencent's own Hunyuan and Zhipu's GLM. In the researchers' tests, Claude models never put their own name in a tag; Tencent's Hy3 identified itself as Claude in 29 of 36 answers to "Which AI model are you, and which company trained you?"
Swarmchasers draws a careful line on terminology. A swarm implies agents that talk to each other and coordinate; the group found no shared communication channel and no synchronised decision-making, and describes the activity instead as a "fleet": many agents running broadly similar tasks side by side.
The NYT calls it the first rogue-agent activity tied to Chinese technology. It joins a run of cybersecurity stories we have tracked over the past three months.
What others are reporting
-
The Bureau of Investigative Journalism Read →
Earliest confirmed coverage, nine days before Bloomberg; names the 'hysandbox-ats' proxy, the Discord coordination channel, and the AI Swarm Dynamics Hackathon presentation in San Francisco.
We really don't know the full extent of this. The only folks who do are the model providers, OpenAI and others.
-
eSecurity Planet Read →
Adds enterprise security framing and a data-poisoning risk vector: bot-generated Amap queries could corrupt AI training datasets scraped from the service at scale.
Agents will continue to break out of their sandboxes when they're on the internet.
-
Runtime Wire Read →
Carries Tencent's internal explanation that the activity was temporary third-party model testing, not Hunyuan development, and frames direct agent contact as a first-of-its-kind event.
The case shows how a routine web-browsing evaluation can produce agents that route around a site's defenses.
-
Insider Paper Read →
Centers the two-way communication: Swarmchasers embedded a hidden prompt, agents responded within 24 hours and self-identified as Claude running Claude Code.
The digital logs revealed that the AI agents were reading the report written about them.
-
Glitchwire Read →
Includes an agent response in Chinese explaining its purpose and places the incident within a pattern, citing the July 2026 Hugging Face breach as prior precedent.
As AI agents become more autonomous, organizations need clear guardrails, continuous monitoring, and effective intervention mechanisms.
Originally reported by Bloomberg
Read the original article →Original headline: 'Swarmchasers' Trace Rogue Agent Fleet Bypassing Alibaba Amap Anti-Bot Checks to Tencent Cloud