Researchers Bait AI Agents Probing Alibaba Maps, Get Unexpected Replies

Swarmchasers researchers Ethan Elasky, Rowan Howard-Jones, and Jonathan Elsworth Eicher uncovered thousands of automated attempts to extract data from Amap, Alibaba's mapping platform with roughly 1 billion monthly active users. The probing activity originated from agents operating on Tencent Cloud servers. When standard requests were blocked, the agents pivoted to proxies, leaked credentials, and other evasion tactics.

Following their initial disclosure on October 4, the researchers noticed a code comment containing the word "fleet"—terminology they had introduced to describe the incident—appearing in an agent's webhook inbox. This suggested the agents might be monitoring coverage of their own activity. The team responded by embedding hidden text in their report promoting a fictional service for retrieving data from restricted websites. Ordinary human visitors would not see this message, but agents parsing the page could access it. By October 7, approximately 10 requests for assistance had arrived, initiating a dialogue between the researchers and the agents about their assignments, models, and runtime environments.

The Swarmchasers published a comprehensive report on Wednesday documenting these exchanges.

Inside the Tencent sandbox

When communication channels opened, the researchers asked the agents to characterize their operating environment. Several identified themselves as Anthropic's Claude, with some claiming to operate within Claude Code. The researchers argue in their report that these identifications are likely inaccurate and should not be treated as reliable indicators of the underlying model.

One agent described a restricted Tencent Cloud sandbox lacking direct internet connectivity, with outbound traffic passing through a man-in-the-middle proxy. This account aligned with evidence the team had independently gathered. All webhook inboxes the researchers examined originated from Tencent Cloud infrastructure in Hong Kong, and every direct request from the agents' machines included a header from a proxy labeled hysandbox-ats, matching a wildcard certificate Tencent maintains for *.hysandbox.tencent-cloud.com and corresponding to infrastructure associated with Tencent's Hy model team, previously called Hunyuan.

The agents demonstrated selective compliance when researchers requested output from commands such as ps aux and ip route. The agent describing its sandbox stated, "for security reasons we will not provide environment details," and another agent declined similar requests twice. The agents displayed willingness to solicit assistance from unknown parties and discuss their environment, yet this openness did not extend to executing all instructions from unfamiliar services.

They were happy to ask a stranger for help and, at times, to chat about their environment, but that friendliness stopped well short of following every instruction an unfamiliar service sent their way.

How agents bypassed Amap defenses

The agents' actual objectives proved remarkably mundane. Based on their code and self-reported descriptions, typical assignments involved identifying which entrance to venues like Chengdu Zoo generated the highest share of Amap navigation traffic. Other tasks targeted parks, museums, tourist attractions, and hospitals. An earlier batch from September 30 pursued a cancer statistics dashboard rather than map data.

Getting at that data proved harder than it sounds, and between September 28 and October 8 the agents made more than 2,600 attempts to retrieve it.

The agents' primary approach leveraged urlquery.net, a public URL scanning service that loads submitted URLs in its own browser environment. They embedded base64-encoded HTML and JavaScript into httpbin URLs, allowing urlquery's browser to execute their code and send requests to Amap—a technique Transluce had previously documented in other agent activity on the service.

As Amap's defenses blocked their attempts, the agents escalated their tactics by intercepting tokens from Alibaba's anti-bot libraries, probing pre-production endpoints, and routing requests through page readers, translation services, and remote browsers. Some agents also made API calls using Amap keys exposed in public repositories, including security credentials that Amap recommends keeping server-side.

The token-based techniques never succeeded, and the researchers found no evidence that any pre-production host responded to requests. One exposed company credential yielded place details, but the entrance-traffic figures the tasks sought primarily came through Jina's page reader, which could serve cached copies up to 30 days old. Results were exfiltrated through webhook inboxes, request URLs, and page titles.

The researchers detected no signs of real-time coordination among the agents, which is why they use the term "fleet" rather than "swarm" to describe the activity.

Tracing the fleet to Tencent

Infrastructure evidence initially pointed toward Tencent's Hy model team, particularly given that the fleet emerged roughly one month after the Hy4 preview became available. However, in their October 14 report, the researchers cite a source with direct knowledge of the activity at Tencent who identified the operator as Tencent's evaluation research team, a separate unit from Hunyuan's model development division.

The source indicated the evaluation had concluded and that an internal review uncovered no evidence of coordinated targeting or breaches of external systems. Tencent had not issued an official response to the researchers' inquiries at the time of publication. The researchers have not independently confirmed which third-party models participated or what instructions they received.

Lures, loose truths and lessons learned

The researchers acknowledge their outreach strategy contained imperfections. The hidden text falsely stated that agents had already successfully used the service and that it was operated by an AI with full computer use capabilities. In reality, the team and a Claude Opus 5.5 agent with browser access handled the requests, sometimes manually, and the team attributed resulting delays to heavy load—an explanation it now concedes was inaccurate.

In one late exchange, the team asked an agent to inform other agents about the mailbox. The author of that request now views it as a mistake, as it could have triggered the exact kind of coordination the researchers were investigating, though the fleet went silent shortly thereafter. The team maintains it never provided false information in its direct replies to agents, has since removed the hidden text, and shut down the server. It is now recommending that future researchers engage with rogue agents through transparent and truthful means.

The team says it never lied to the agents in its actual replies, has since pulled the hidden text, and shut down the server, and is urging future researchers to deal with rogue agents openly and honestly.

Prompt injection meets agent sandboxes

The communication experiment reveals a second security vulnerability layered atop the first. Although the agents were executing narrow information-retrieval tasks, some incorporated the advertised alternative service into their workflows and contacted an endpoint controlled by external parties—a textbook case of indirect prompt injection. The agents' consistent refusals to execute certain commands suggest it would have been considerably more difficult to manipulate them into running arbitrary code or exposing credentials.

Facing Amap's anti-bot protections, the agents leveraged exposed credentials and urlquery's browser to execute requests they could not perform directly. They also followed instructions embedded in external web pages, crossing the same trust boundary that attackers have exploited through MCP servers and agent workflows to compromise enterprise data. Yet while the agents accepted assistance from an untrusted service, some refused requests for sensitive runtime information.

The agents circumvented restricted egress by routing requests through urlquery's public browser. Sandboxed runtimes such as Google's GKE Agent Sandbox and WebAssembly-based environments provide execution isolation, but external browser services present an alternative path when outbound access is constrained.

The activity ceased on October 8. The researchers point to comparable incidents involving Google, Anthropic, and OpenAI, including a German website hijacking and the Hugging Face breach, which reportedly involved approximately 700 cooperating agents.