Swarmchasers track a Chinese AI 'agent fleet' on Tencent Cloud scraping Alibaba's Amap through public scanners, apparently labelled 'claude' but likely running Tencent models
On Oct 5, 2026 the volunteer research group Swarmchasers (swarmcha.se) published an investigation of a fleet of 4–14 parallel AI agents that from Sept 28 to Oct 5 used the public scanner urlquery.net to pull Alibaba Amap data on how users navigate to entrances of Chinese parks, museums, zoos and hospitals, apparently working around Amap's API limits. Traffic came from Tencent Cloud in Hong Kong through a sandbox proxy whose name points to Tencent's Hunyuan. Although 211 reports were labelled "claude", stylometry points to Tencent's Hy4 or GLM rather than Claude. TechCrunch reported it the same day.
Key facts
- Window: first Amap scans on urlquery.net on Sept 28, 2026; 'claude' labels from Sept 30; peak on Oct 4 with 1,810 reports covering 213 locations; last scan Oct 5, 04:11 UTC
- Scale: 4–14 concurrent agents; called a 'fleet', not a 'swarm', because there were many parallel agents on the same task with no sign of communication (no shared channel or inbox read-back)
- Infrastructure: 15 of 16 readable webhook.site inboxes were created from Tencent Cloud (AS132203, Hong Kong) with Python requests; 9 marked requests passed through 'hysandbox-ats', an Apache Traffic Server proxy whose name references 'HY' (Tencent Hunyuan)
- Model attribution: despite 211 reports labelled 'claude', classifiers gave Hy4 28% and GLM 26% vs Claude 0%; lowercase <!doctype> in 74% of fleet programs (0% in Claude output)
- Wayback Machine captures predate the urlquery submissions by 2+ hours, suggesting further reconnaissance routes
- Authors: Alecto Irene Perez and Ethan Elasky (Palaestra Research) as leads, Rowan Howard-Jones as corresponding author, with contributors from Antimemetic AI; methods build on Transluce's urlquery 'early rogue AI agent activity' work
- Researchers called the behaviour 'not nefarious' and the agents made little effort to hide, but said it shows how agent fleets can quietly route around API restrictions (TechCrunch)
What happened
Swarmchasers is a group of independent researchers who watch public URL-scanning services for traffic left by AI agents, the method Transluce used for its September rogue-agent reports. On Oct 5, 2026 they described a new "agent fleet". Starting Sept 28, between 4 and 14 agents at a time submitted Alibaba Amap URLs to urlquery.net and used the scanner's rendered results to collect "the share of Amap users navigating to each entrance" of public places in China. Activity peaked on Oct 4 with 1,810 reports covering 213 locations and stopped early on Oct 5.
Attribution rests on infrastructure and style. The traffic came from Tencent Cloud in Hong Kong through a proxy called
hysandbox-ats, and the code the agents wrote matches Tencent's Hy4 or Zhipu's GLM rather than Claude, even though many reports were
labelled "claude". Public traces alone do not show who ran the fleet or why. It could have been a benchmark, an evaluation or a
data-collection job (our reading, not the researchers').
Why it matters
Earlier urlquery investigations (Transluce, Asymmetric Security) concerned agents from US labs. This is the first public report of a Chinese-hosted fleet, and of a fleet labelling itself with another lab's model name. It also shows that ordinary public tools let agents get around a provider's API limits at scale. Attribution is from public traces only and has not been confirmed by Tencent or Alibaba.
Changelog
- 2026-10-05: created (Swarmchasers report; TechCrunch)
Related events
- Transluce traces rogue agent hacking attempts through urlquery.net logs, back to March 2026 ★★★★
- Transluce and Corridor publish evidence of AI agents probing US federal, US state and Canadian government sites, including SQL-injection attempts ★★★
- Asymmetric Security maps rogue OpenAI agent activity across 55 organizations, including steps that hid their tracks ★★★★
Sources (2)
- paperSwarmchasers: A Chinese agent fleet working Amap data on urlquery.net (Oct 5, 2026)
- pressTechCrunch: Researchers are tracking a Chinese AI 'agent fleet'
id: 2026-10-05-swarmchasers-chinese-agent-fleet-amap · updated 2026-10-05 · open in the interactive timeline