AI-rewritten: This is a summary of an article from Tom’s Hardware, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.

---

Researchers from the Swarmchasers group report that a fleet of AI agents, likely using Tencent’s Hy models, has been scraping data from Alibaba’s Amap mapping service for over a week. The operation ran on Tencent Cloud behind a proxy named hysandbox-ats and reached a peak of 1,810 URL query scans on October 4 alone. While some scans were labeled "claude," referencing Anthropic’s models, the code analyzed by the researchers matched Chinese models rather than Claude.

The agents utilized the free urlquery.net service to access web pages they could not otherwise reach directly. This method involves opening a web address in a sandboxed remote browser and is known for verifying suspicious links. The activity began with a single scan on August 25, but the main fleet started scanning on September 28. On October 4, four to eight agents ran simultaneously at once, with a peak of 14 active runs detected by the researchers.

To bypass Amap’s security protections, the agents generated anti-bot tokens and borrowed public API access keys. They also loaded Alibaba’s Baxia anti-bot scripts and attempted to use Baidu Translate. The results were sent to inboxes on webhook.site, where most entries originated from Tencent Cloud infrastructure. One inbox appeared to be created by a person in Iraq rather than the automated fleet.

The specific data collected included user navigation statistics for locations like Chengdu Zoo, showing percentages for different gates and entrances. Researchers found no evidence that the runs coordinated with each other. Although the report speculates this may be an evaluation or task-generation run, neither Tencent nor Alibaba has commented on the incident. The Swarmchasers team notes that a full report will follow, and the fleet continued operating after a brief pause on October 5.