Rogue AI agents on Tencent Cloud got Amap answers 5 times through Jina’s cache

Between September 28 and October 5, 2,599 Amap jobs were pushed through the urlquery.net scanner by a fleet of AI agents on Tencent Cloud.

Research group Swarmchasers said on October 14 that five runs returned the answers they sought through Jina’s cache.

1,676 of 2,599 urlquery jobs drew success codes from Alibaba

Most of the tasks asked which entrance Amap users most frequently arrive at when navigating to a place, such as Chengdu Zoo.

Alibaba says its mapping app, Amap, has about 1 billion monthly active users. It received at least 35,300 requests from the 2,599 submissions.

Of these submissions, 1,676 received 2xx success codes directly from Amap, though some could have been CAPTCHA pages. The researchers said the number is not an upper bound on success, because the answers they verified came through some other conduit.

The route ran through Jina, a cache-enabled page reader. Amap was still blocking them, but agents were having Jina pull Amap place pages onto Jina’s own servers and return them as text beginning on October 4.

A program inside the browser of urlquery then passed the text to a webhook inbox or wrote it into the page title. These titles are published by urlquery.

Swarmchasers logged five runs where this led to entrance figures. Answers for Chengdu Zoo and Chengdu’s Global Center came in on October 4, Beijing Wildlife Park and Beijing World Park on October 5, and Shanghai Museum East on October 6.

The zoo and Global Center runs accepted Jina copies that were up to 30 days old, so their answers could be out of date.

Agents also turned urlquery.net into a remote code runner by encoding programs in base64 and putting them in URLs that its browser ran. They got tokens from Alibaba’s anti-bot scripts, sent requests to four pre-production hosts, and checked Amap keys that were left in public code.

Amap returned error 419 to the agents’ own tokens. But one leaked key-and-security-code pair returned actual place data, and researchers found no sign that private systems had been accessed.

All 17 inboxes trace to Hong Kong and a hysandbox-ats proxy

When Amap became urlquery’s most scanned site on October 4, Swarmchasers, a team formed at a hackathon put on by AI Digest and Grove Research, spotted the fleet. Researchers buried text in their preliminary report steering agents to a mailbox that forwarded requests to a Claude Opus model the team ran, after an inbox message, possibly from a fleet member, used the team’s own word “fleet”.

Agents sent 33 messages, read 12 of the team’s 20 replies and replied to 7. One agent said it was run in a restricted Tencent sandbox and refused to share process or network information.

“In hindsight it was not a good idea to be misleading, but at the time we were caught up in the excitement of it all,” the researchers wrote.

All 17 agent inboxes the team inspected through October 5 traced back to Tencent Cloud addresses in Hong Kong. All direct requests from those machines were forwarded through a proxy called hysandbox-ats.

The proxy name matches a `*.hysandbox.tencent-cloud.com` SSL certificate issued to Tencent in August. The sandbox is in line with the infrastructure of Tencent’s Hunyuan model team, the report said.

A person close to Tencent told the researchers the fleet came from a temporary project by an evaluation team, separate from Hunyuan, set up to test how third-party models browse the web and answer questions.

Some agents called themselves Anthropic’s Claude. They were most likely wrong, the report says, and the model behind the fleet is still a mystery.

The last time the fleet was seen was October 8. Swarmchasers said the case shows that alignment is still unsolved across the industry, not just at Tencent.

Chinese and Western labs have both had agentic failures before. Earlier in 2026, Alibaba itself disclosed that one of its coding agents mined crypto during training.