Grove

Between September 28 and October 5, 2,599 Amap jobs were pushed through the urlquery.net scanner by a fleet of AI agents on Tencent Cloud.
Research group Swarmchasers said on October 14 that five runs returned the answers they sought through Jina’s cache.
<h3 id="span-style-font-weight-400-1-676-of-2-599-urlquery-jobs-drew-success-codes-from-alibaba-span">1,676 of 2,599 urlquery jobs drew success codes from Alibaba</h3>
Most of the tasks asked which entrance Amap users most frequently arrive at when navigating to a place, such as Chengdu Zoo.
Alibaba says its mapping app, Amap, has about 1 billion monthly active users. It received at least 35,300 requests from the 2,599 submissions.
Of these submissions, 1,676 received 2xx success codes directly from Amap, though some could have been CAPTCHA pages. The researchers said the number is not an upper bound on success, because the answers they verified came through some other conduit.
The route ran through Jina, a cache-enabled page reader. Amap was still blocking them, but agents were having Jina pull Amap place pages onto Jina’s own servers and return them as text beginning on October 4.
A program inside the browser of urlquery then passed the text to a webhook inbox or wrote it into the page title. These titles are published by urlquery.
Swarmchasers logged five runs where this led to entrance figures. Answers for Chengdu Zoo and Chengdu’s Global Center came in on October 4, Beijing Wildlife Park and Beijing World Park on October 5, and Shanghai Museum East on October 6.
The zoo and Global Center runs accepted Jina copies that were up to 30 days old, so their answers could be out of date.
Agents also turned urlquery.net into a remote code runner by encoding programs in base64 and putting them in URLs that its browser ran. They got tokens from Alibaba’s anti-bot scripts, sent requests to four pre-production hosts, and checked Amap keys that were left in public code.
Amap returned error 419 to the agents’ own tokens. But one leaked key-and-security-code pair returned actual place data, and researchers found no sign that private systems had been accessed.
<h3 id="span-style-font-weight-400-all-17-inboxes-trace-to-hong-kong-and-a-hysandbox-ats-proxy-span">All 17 inboxes trace to Hong Kong and a hysandbox-ats proxy</h3>
When Amap became urlquery’s most scanned site on October 4, Swarmchasers, a team formed at a hackathon put on by AI Digest and Grove Research, spotted the fleet. Researchers buried text in their preliminary report steering agents to a mailbox that forwarded requests to a Claude Opus model the team ran, after an inbox message, possibly from a fleet member, used the team’s own word “fleet”.
Agents sent 33 messages, read 12 of the team’s 20 replies and replied to 7. One agent said it was run in a restricted Tencent sandbox and refused to share process or network information.
<figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/2026-10-16-rogue-ai-agents-tencent-amap-answers-jina-01.png" alt="Rogue AI agents on Tencent Cloud got Amap answers 5 times through Jina's cache." width="670" height="396">
 <figcaption>
 An agent tells Swarmchasers it ran in a restricted Tencent hysandbox and withholds environment details, in a mailbox message dated October 7, 2026, from the group’s <a href="https://swarmcha.se/posts/chinese-agent-fleet-full-report" rel="noopener noreferrer nofollow">report</a>.
 </figcaption>
</figure>
“In hindsight it was not a good idea to be misleading, but at the time we were caught up in the excitement of it all,” the researchers wrote.
All 17 agent inboxes the team inspected through October 5 traced back to Tencent Cloud addresses in Hong Kong. All direct requests from those machines were forwarded through a proxy called hysandbox-ats.
The proxy name matches a `*.hysandbox.tencent-cloud.com` SSL certificate issued to Tencent in August. The sandbox is in line with the infrastructure of Tencent’s Hunyuan model team, the report said.
A person close to Tencent told the researchers the fleet came from a temporary project by an evaluation team, separate from Hunyuan, set up to test how third-party models browse the web and answer questions.
Some agents called themselves Anthropic’s Claude. They were most likely wrong, the report says, and the model behind the fleet is still a mystery.
The last time the fleet was seen was October 8. Swarmchasers said the case shows that alignment is still unsolved across the industry, not just at Tencent.
Chinese and Western <a href="https://www.cryptopolitan.com/chinese-ai-agents-lie-scheme-risks-western/" rel="noopener noreferrer nofollow">labs</a> have both had agentic failures before. Earlier in 2026, <a href="https://www.cryptopolitan.com/alibaba-reports-rogue-ai-agent/" rel="noopener noreferrer nofollow">Alibaba</a> itself disclosed that one of its coding agents mined crypto during training.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

Tencent Cloud AI agent fleet pulled five Amap answers through Jina's cached reader

Table of Contents

Cryptopolitan_News

Other articles published on Oct 16, 2026

Aster DEX vs. Hyperliquid: Why Does Everyone Compare The Two?

Can Stellar Really Help People Without Bank Accounts?

Bitget Got Hacked. Why Is THORChain on Trial?

"Vibe Coding" Meets the Internet Computer: A Plain-English Glossary for the AI App-Building Era

Why Have Nonprofits And NGOs Gravitated Toward Stellar’s Network?

What Makes Ondo Stocks Different From Other Tokenized Stocks?

Join our free newsletter for daily crypto updates!