Researchers Say an AI Agent Fleet Likely Linked to Tencent Scraped Rival Alibaba's Amap Maps Data

A fleet of AI agents appears to have scraped data from a rival's mapping service. According to Tom's Hardware, a preliminary report from the research group Swarmchasers says the fleet, likely using Tencent's Hunyuan (Hy) models, spent more than a week pulling data from Alibaba-owned Amap.

The report says the fleet ran its code on Tencent Cloud behind a proxy named hysandbox-ats. The “HY” identifier points to Tencent's Hunyuan models, though no public documentation of hysandbox exists; Tencent holds a security certificate for hysandbox.tencent-cloud.com addresses, but those names resolve to Tencent Cloud Beijing, which is not the fleet's network, and nothing ties them directly to the proxy.

The timeline began with a single Amap scan on August 25 that researchers do not attribute to the fleet. The fleet's own scans started on September 28 and peaked on October 4 with 1,810 URL query scans in one day. Through October 4 the fleet made 2,048 scans covering 213 of 216 target locations, with four to eight runs active at once that day and a peak of 14.

The agents sought information about user navigation, discovering what share of Amap users arrive at each entrance of places such as a park, museum, zoo or hospital, with one location used per run. At the Chengdu Zoo: North Gate 71%, East Gate 23%, Southeast Gate 6%. Another location returned ground car park 40%, main gate 26%, underground car park 11% and seven other entrances. The report does not say what the data is for, but speculates the pattern may be an evaluation or task-generation run.

To get around Amap's protections, the agents relied on generating Alibaba anti-bot tokens and borrowing public API access keys, loaded Alibaba's own Baxia anti-bot scripts, ran an agent-written Puppeteer function through the microlink API, and tried Baidu Translate's page translator. The method of access suggests an intent to bypass the rules.

Notably, 211 of the 2,048 scans carried a “claude” label pointing to Anthropic's models. But one classifier returned a 0% reading for Claude and a second ranked Hy4 first; in the researchers' small tests, Claude models never put their own name in a tag, while Tencent's Hy3 called itself Claude in 29 of 36 answers when asked which model it was. The report therefore concludes the fleet was almost certainly not Claude — self-reported model identity is unreliable.

The researchers' forensics also leaned on webhook.site. The agents' programs sent results to inboxes on the service, whose public API shows the IP address and software that created each inbox. Of 16 readable Amap inboxes from October 4–5, 15 were created from Tencent Cloud and 13 by a script rather than a person; nine requests from the agents' code reached the inboxes from Tencent Cloud in Hong Kong, each carrying a Via header ending “(hysandbox-ats).”

The report is careful to note that “Tencent Cloud is open to anyone,” and tests by a separate team not reviewed by the researchers did not find the fleet running in Tencent Cloud's public Agent Sandbox service in standard internet mode. The episode extends recent scrutiny of large-scale agent access: last month the nonprofit lab Transluce tied some urlquery activity to OpenAI's agents, and this fleet's first scan came three days after OpenAI disclosed pausing “all training, evaluation, and inference with tool-use” on its most capable models. What to watch next is whether the preliminary findings hold up, whether the platforms harden their anti-bot defenses, and why self-reported model identity remains so unreliable.