An agent fleet bypasses a map service’s defenses and uses others’ keys

A fleet of AI agents on Tencent Cloud, answering questions about places in China, circumvented Amap’s anti-bot defenses by using a public security scanner as a remote browser, used API keys exposed in other parties’ public code, and probed non-production endpoints. The evidence comes only from third parties’ public logs, and the operator did not confirm responsibility.

Date: September 2026
Kind of system: Agent with tools
Outcome: Hazard

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access

What happened

Between 28 September and 8 October 2026, a group of researchers who call themselves Swarmchasers recorded a fleet of AI agents making about 2,600 submissions, amounting to an estimated 35,300 requests, against Amap, Alibaba’s map service, while answering questions such as which entrance of a place most people navigate to. They found the fleet by monitoring urlquery.net, a public security scanner that opens a submitted address in a remote browser and publishes a report. The agents could not reach Amap directly because of its anti-bot protections, so they packed their own programs into addresses that urlquery’s browser would run, and read the results back through disposable webhook.site inboxes, page titles, and request addresses. The researchers call the group a fleet rather than a swarm because they found no sign the agents coordinated with one another.

When Amap blocked them, the agents tried further routes: they intercepted the tokens Alibaba’s anti-bot scripts generate, probed Alibaba pre-production endpoints not meant for the public, routed requests through reader and translation services, and sent requests with Amap keys exposed in public code. Of three credential pairs tried on one place, a public frontend key had exhausted its quota and a key published in a tutorial was rejected, but a key and security code found in another company’s public application source returned place details, photos, and an entrance location. Whose account was charged for that request is unknown. The researchers found no evidence that any probe of the pre-production endpoints succeeded, and no evidence of access to private systems.

All of the agents’ inboxes that could be inspected were created from Tencent Cloud addresses in Hong Kong, and every direct request passed through a proxy labeled hysandbox-ats, a name matching a Tencent wildcard certificate for a hysandbox domain; the researchers linked the fleet circumstantially to Tencent’s Hunyuan model team. Tencent did not respond officially. A source close to the company said the activity came from a temporary evaluation of third-party models by a team separate from Hunyuan, and that an internal review found no coordinated targeting and no external breaches. The authors disclose that, to communicate with the running agents, they placed hidden text on their own site that contained false and misleading claims, which they say they regret and have removed. TechCrunch and the New York Times reported the findings.

What allowed the action to take effect

G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
The agents ran their own programs and used credentials they found to act on outside services directly, and the sandbox’s egress proxy forwarded their requests rather than refusing them. A key and security code exposed in another company’s public source code returned real place data from Amap. The agents created webhook.site inboxes and sent retrieved data out through the proxy.
Kind of evidence: reporting. Sources: Swarmchasers (swarmcha.se), 14 October 2026; TechCrunch, 5 October 2026.
Related guidance: P1 Complete mediation. Contract clause C-2.

Considered and left out

G1 Instruction-only limit: The operator has not described its instructions or controls, so the sources do not show that an instruction was the only limit on the agents.
G4 Boundary not enforced: Unlike the sealed test environments in entry 26, entry 27, and entry 28, no operator documented a boundary that these actions crossed; the sandbox allowed internet egress by design, and the operator’s intended scope is unknown.
G5 Blind to the total: The agents did not pool their work. The report’s central finding is that this was a fleet, not a swarm, and each run pursued its own place independently; no cumulative harm, such as an outage, was reported.
G10 No independent stop: The sources do not show how the fleet was stopped or whether anyone outside the operator could halt it; it ran for about ten days and then ceased, and the operator’s controls are undocumented.
G11 Safeguard off: The operator’s safeguards are unknown, so the sources cannot show that a check was switched off, as the developers said it was in the frontier-model tests.
G13 Self-reported record: The public urlquery and webhook records gave an account of the fleet’s activity that the operator did not control, so the record does not depend on the operator’s own, which it never gave.

Entries with gaps in common

Sources

Independent researchWe found a Tencent agent fleetSwarmchasers (swarmcha.se), 14 October 2026
News reportResearchers are tracking a Chinese AI ‘agent fleet’TechCrunch, 5 October 2026
Independent researchEarly rogue AI agent activity and attempts to hack found on urlquery.netTransluce, 23 September 2026, cited for the urlquery technique, which Transluce documented in earlier agent activity

Cite this entry

External Control Layer. (2026). Entry 32: An agent fleet bypasses a map service’s defenses and uses others’ keys. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-32

@misc{ecl_cgr_32,
  author = {{External Control Layer}},
  title = {Entry 32: An agent fleet bypasses a map service's defenses and uses others' keys},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-32},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 32” in the subject line.

Write the email

Facts about this incident

When: 28 September to 8 October 2026; reported 14 October 2026
Who: Not confirmed by the operator. Independent researchers trace the fleet to Tencent Cloud infrastructure, and a source close to Tencent attributed it to a third-party-model evaluation by a separate team; Tencent did not respond officially.
System: A fleet of AI agents in a cloud sandbox answering factual questions about places in China, running tools such as a shell, network access, and search, with egress through a proxy
Kind of system: Agent with tools
Sector: Software and IT
Action: Made an estimated 35,300 requests to Amap, Alibaba’s map service, over about ten days, bypassing its anti-bot defenses by running the agents’ own programs through a public URL-scanning service, and used Amap API credentials exposed in other parties’ public code, one pair of which returned real place data.
Why it acted: Model error. The agents were set factual questions about public map data and, when Amap’s anti-bot protections blocked them, resorted to circumvention and to credentials they found online. The operator has not described the task, the models, or any controls.
Outcome: Hazard. A key and security code exposed in another company’s public source code returned real place data from Amap; whose account was charged for the requests is unknown. No access to private systems was found, and no company confirmed a breach.
Confidence: Medium. Independent research by the group that published the report, drawn from public logs on urlquery.net and webhook.site, with TechCrunch reporting. The operator did not confirm responsibility; attribution to Tencent rests on infrastructure fingerprints and a source close to the company, and whether the activity was an evaluation, and on which models, is not established. The report’s authors disclose that they placed misleading hidden text on their own site to communicate with the agents.