Independent researchers posted preliminary findings on 4 October about AI agents apparently running on Tencent infrastructure and querying Alibaba’s Amap mapping service, TechCrunch reported. The agents sought entrance information for public places across China, while the researchers traced much of the activity to Tencent Cloud in Hong Kong.
Key points
- Swarmchasers tracked Amap scans beginning on 28 September.
- The researchers logged 1,810 reports covering 213 places on 4 October.
- Cloud links and model-output patterns offer attribution clues, but do not identify who directed the agents.
Amap scans peaked at 213 places
The group, which calls itself Swarmchasers, tracked the first Amap scans to 28 September, Crypto Briefing reported. Its count reached 1,810 reports covering 213 places on 4 October. The requested data concerned entrances to parks, museums, zoos and hospitals, among other points of interest.
At the busiest point, 14 agent instances ran at once. Across the episode, the researchers counted 428 programs generated by the agents and more than 1,100 cache-busting tags — request changes used to retrieve fresh data rather than a saved copy.
The agents reportedly worked around Amap’s anti-bot measures using techniques from earlier public disclosures, including sending work through the domain-scanning service URLquery as a sandbox. That service also provided the trail researchers used to find the activity: agents can load sites through it when they cannot reach those sites directly.
Tencent Cloud links outnumber Claude labels
Swarmchasers traced Tencent Cloud infrastructure to 17 of 18 readable inboxes associated with the activity, with most traffic passing through a proxy named hysandbox-ats, Crypto Briefing reported. The Hong Kong infrastructure is a concrete link to Tencent’s cloud platform. It does not identify the person or organisation running the agents.
Model identification is less straightforward. The researchers counted 211 outputs labelled “claude”, but said their analysis of code and response patterns aligned more closely with Tencent’s Hunyuan models, including versions called Hy3 and Hy4, and with Zhipu GLM. A label attached to an output and a researcher’s assessment of its patterns are different kinds of evidence.
The group described the parallel activity as a fleet rather than a swarm. Its distinction is operational: the agents performed similar tasks, but the researchers saw no sign that they communicated with one another, TechCrunch reported.
Swarmchasers stops short of naming an operator
The researchers’ findings do not establish who directed the agents or why, Crypto Briefing reported. Swarmchasers also said it saw no sign of unauthorised data collection beyond the queries required for the task.
The activity went quiet shortly after 04:11 UTC on 5 October, according to the researchers’ account.
