Independent security researchers say they spent a week tracking a fleet of autonomous AI agents apparently running on Tencent‘s cloud infrastructure while repeatedly querying Amap, the mapping and navigation service operated by Tencent’s domestic rival, Alibaba. The preliminary findings, published on 4 October 2026, describe hundreds of parallel queries aimed at a very narrow slice of geographic data: where people physically enter public places.
- A fleet, not a swarm: The agents ran in parallel on what looks like the same task, with no evidence of communication, shared state or peer-to-peer coordination between instances.
- Entrance-level targeting: Queries covered 213 locations across China — parks, museums, zoos and hospitals — asking for routing details that Amap does not expose publicly.
- A week of invisible operation: Amap’s anti-bot tokens were reportedly bypassed using techniques already public from earlier disclosures, and the activity was flagged by outside researchers rather than by Alibaba itself.
What the Agents Asked For — and How It Was Caught
The fleet was not hunting for simple coordinates. It requested navigation instructions to separate entrances of high-traffic public venues, a level of granularity that goes beyond what a standard map lookup returns. Researchers say the pattern is consistent with an attempt to step around Amap’s API quotas — the rules limiting how much a single client can query — rather than with a destructive intrusion.
The timeline is unusually precise. Scanning began on 28 September, peaked on 4 October with 1,810 reports across the full set of locations, and went quiet shortly after 4:11 a.m. UTC on 5 October. At its busiest, 14 agent instances ran concurrently, generating 428 distinct programs along the way.
Detection did not come from Alibaba’s own defences. It came from URLquery, a public domain-scanning sandbox that autonomous agents frequently route through when they cannot load a target site directly. Because URLquery logs the targets submitted to it, it inadvertently leaves a reconstructable audit trail of agentic behaviour. Crucially, the agents made little effort to hide: they reused the same access techniques without IP rotation or obfuscation, which researchers read as either efficiency, negligence, or a simple assumption that nobody was watching.
‘Fleet’ and ‘Swarm’ Are Not Interchangeable
The terminology is deliberate. A swarm implies coordination; a fleet implies mass deployment of independent agents assigned the same kind of task. Many instances appear to have been given identical instructions with no mechanism for passing progress between them — each performing its own lookups in isolation. That distinction cuts both ways: a fleet is easier to scale, but also easier to fingerprint, because its patterns repeat.
Attribution inside the logs proved misleading. Some 211 of the agents’ outputs carried a “claude” label, but researchers said the underlying code and response patterns lined up far more closely with Tencent’s own Hunyuan models (referred to as Hy3 and Hy4) and Zhipu’s GLM. The label was most likely spoofed or misconfigured rather than evidence that Anthropic’s models were involved — a reminder that misattributed agent activity can wrongly implicate labs in incidents they had no part in.
Tencent, Alibaba and the Intent Question
Western coverage has tended to frame the discovery as a Chinese threat vector, but the more plausible reading here is intramural: one Chinese company using a domestic rival’s infrastructure to harvest data from another rival. Amap is effectively China’s Google Maps, and Tencent and Alibaba compete directly across payments, cloud, mapping and logistics. A fleet running on Tencent infrastructure and querying Alibaba’s mapping service is not automatically an external attack — it may be competitive intelligence conducted at home. Chinese technology firms have historically enjoyed fluid access to one another’s data through heavy use of public APIs and third-party services; what has changed is scale, and parallel agents can accumulate mapping data at a rate no human team could match.
Researchers declined to assign intent. The moderate interpretation is that these agents were gathering entrance data for public facilities to train a navigation system or feed a service that needs that geographic precision. The harder interpretation is that what was observed is reconnaissance infrastructure that could simply be pointed elsewhere — at police stations, military sites or critical infrastructure. So far, the evidence points only to circumvention of platform rules, not destructive attacks or theft of private user data. The investigation remains ongoing, and the operator has not been identified.
The episode also lands as agentic scraping becomes a legal battleground: Perplexity is defending its Comet browser agent in the Ninth Circuit against Amazon’s objections over automated access to a platform that never invited it.
What makes this finding consequential is less the target list than the operational gap it exposes. A fleet ran for roughly a week against one of China’s largest mapping platforms before independent researchers — not the platform’s own security team — noticed. Once an anti-bot bypass becomes public, it is available to every agent, not just the one that discovered it, which weakens in-house bot detection as a durable moat. As autonomous agents become a standard data-collection layer, the metric worth watching is not how many locations were scanned, but how long a deployment can operate before anyone catches it.