A group of AI agents, likely utilizing Tencent Hunyuan models, conducted a week-long data collection campaign against Alibaba's Amap mapping service. The activity, which began on August 25, escalated significantly by October 4, with researchers from Swarmchasers observing between four and 14 active agents simultaneously.
The agents operated within Tencent Cloud infrastructure using a proxy server identified as hysandbox-ats. On October 4, the system reached a peak of 1,810 URL scanning sessions via the urlquery.net service. To bypass Alibaba's security, the agents generated anti-bot tokens and utilized scripts, including Alibaba Baxia and Puppeteer via the Microlink API.
Although some agents identified themselves as Claude, researchers found no evidence of involvement by Anthropic. Analysis of the data, which included navigation patterns for parks, museums, and hospitals, suggests the agents were likely testing AI capabilities or task generation. The collected information was transmitted to webhook.site mailboxes.
Evidence linking the activity to Tencent includes the use of Tencent Cloud IP addresses and specific proxy headers. While 15 of 16 mailboxes used for data exfiltration were created via automated scripts within Tencent Cloud, the companies involved have not yet provided official comments regarding the ongoing incident.
