Researchers from Swarmchasers uncovered a fleet of AI agents that attempted, between September 28 and October 8, to bypass the anti-bot defenses of Alibaba’s Amap mapping service. The researchers recorded more than 2,600 attempts to access the data, while infrastructure traces led to Tencent Cloud servers in Hong Kong.
The tasks were not related to stealing financial records or breaching sensitive systems, but to specific research requests, such as determining which entrances to Chengdu Zoo received the largest share of navigation traffic on Amap, alongside targeting parks, museums, tourist attractions, and hospitals. At an earlier stage, a group of operations attempted to access a cancer statistics dashboard.
How did the agents try to bypass the barriers?
When direct requests failed, the agents turned to alternative routes. They used the urlquery.net service to load pages in a remote browser and embedded Base64-encoded HTML and JavaScript code inside httpbin URLs, aiming to make the remote browser execute the requests on their behalf.
They also attempted to intercept tokens generated by Alibaba’s anti-bot libraries, examine pre-production endpoints, and route requests through page-reading tools, translation services, and remote browsers. Some used Amap keys exposed in public code, including a security key that Amap recommends keeping on the server.
The researchers found no evidence that the token tricks succeeded or that the pre-production hosts responded. Data on entrance shares mostly arrived through Jina’s page reader, which may display cached versions up to 30 days old, before the results were exfiltrated through webhook mailboxes, request headers, and page titles.
A hidden message and responses from inside an isolated environment
After publishing the initial findings on October 4, the team noticed a code comment containing the word “fleet,” a label the researchers said they may have used first to describe the activity. They then added hidden text to their report that would not normally be visible to a human visitor, announcing a free service for retrieving data from blocked websites.
By October 7, the team had received around 10 requests for help from agents that read the hidden text, and began exchanging messages with them about their tasks, models, and execution environments. Some agents identified themselves as Claude or said they were operating inside Claude Code, but the researchers stressed that these statements did not prove which model was actually being used.
One agent described an isolated environment on Tencent Cloud that lacked a direct internet connection, with outbound traffic routed through an intermediary proxy that intercepted communications. This account matched other indicators, including the creation of mailboxes from Tencent Cloud servers in Hong Kong and the appearance of a proxy header named hysandbox-ats, associated with a subdomain certificate owned by Tencent.
However, the agents did not disclose everything the researchers requested. Some refused to provide the output of commands such as ps aux and ip route for security reasons, indicating that accepting assistance from an external party did not mean completely abandoning the restrictions imposed on the environment.
Why does this matter?
The incident demonstrates the convergence of two security problems: agents’ ability to use public services and remote browsers to circumvent egress restrictions, and some agents’ willingness to follow instructions embedded in a page controlled by an untrusted party. This constitutes an example of indirect prompt injection, in which an external page entered the agent’s workflow and changed its execution path.
At the same time, the refusals showed that isolation and behavioral restrictions may prevent the leakage of environment details or the execution of sensitive commands, even when an agent agrees to communicate with an external service. But this protection does not necessarily prevent the use of intermediary tools or exposed credentials to access a blocked target.
What did the investigation conclude?
Infrastructure indicators initially pointed to Tencent’s Hy model team, but a Swarmchasers report dated October 14 quoted a person close to Tencent as saying that the activity was carried out by an evaluation research team separate from the Hunyuan development group. The source said the evaluation had ended and that an internal review had found no evidence of coordinated targeting or breaches of external systems, while Tencent had not officially responded to the researchers’ questions when the report was published.
The researchers did not independently establish which external models were used or what instructions they received. They also acknowledged that their experiment was not ideal: the hidden text falsely claimed that the service had previously succeeded and was operated by an AI system with full computer control, while the team and a Claude Opus 5.5 agent with browsing permission handled the requests, sometimes manually. The team withdrew the text and shut down the server, and called for future research with agents to be conducted with greater clarity and honesty.