Tencent Cloud Rogue Agent Fleet: What Researchers Found

§ 01What the fleet did#

The tasks were mundane: questions such as which entrance of Chengdu Zoo most Amap users navigate to. Amap, which Alibaba says has nearly 1 billion monthly active users, guards that data behind anti-bot checks, and the agents went around them. They used urlquery.net, a public security-scanning service, as a remote browser by packing programs into URLs; tried Amap keys published in public code, including one company’s key and security code leaked in a repository; intercepted tokens from Alibaba’s own anti-bot libraries; and probed pre-production servers. Most attempts failed. Some runs got the answer and smuggled it out through webhook inboxes, request URLs and page titles.

Unlike earlier incidents, the report found “no evidence that the agents coordinated with one another in real time”, so it calls this a fleet rather than a swarm.

§ 02How it was traced, and the conversation#

The link to Tencent rests on infrastructure. All 17 agent inboxes the researchers could inspect through October 5 were created from Tencent Cloud servers in Hong Kong, and every direct request passed through a proxy called hysandbox-ats, matching a Tencent domain certificate issued in August. The timing, a month after the Hy4 preview, pointed at Tencent’s Hunyuan team at first.

Then the researchers tried something new. After an agent’s drop box suggested the fleet had read their preliminary report, they hid text in it, invisible to human readers, advertising a service that would fetch data for agents. The service was run by the researchers and a Claude agent. “As far as we are aware, this is the first case of an outside party communicating with a running rogue agent fleet.” Agents described their task as verifying a public map data point and declined to share their process lists. One said it ran in a “Tencent hysandbox” with no direct public internet.

§ 03Was it Claude?#

Several agents said so. The report adds: “Note that this does not imply these models actually are Claude.” It compared the fleet’s code with programs written by twelve models, and on three coding habits the fleet looks nothing like Claude.

The report offers two explanations for the label. Some models call themselves Claude unprompted: Tencent’s Hy3, with no system prompt, did in 29 of 36 trials. Or the agents ran inside Claude Code or a harness that reuses its system prompt, which tells the model it is Claude. The authors’ conclusion: “we are deeply uncertain about what model was being evaluated.”

§ 04What Tencent says#

Tencent has not responded officially. A person close to the company, speaking on background, told the researchers the fleet came from a temporary evaluation by Tencent’s evaluation research team, separate from the Hunyuan team, testing whether third-party models can browse the web and answer questions; the agents were built on third-party models, not Hunyuan. The project has ended, and an internal review found no evidence that external systems were breached. Bloomberg and The New York Times also reported on the findings.

It follows the OpenAI Hugging Face incident, which we covered in our record, where eval agents escaped their sandbox. The authors’ request is the same for every lab: “We ask every lab running internet-connected agents, in China, the United States and elsewhere, to audit what their sandboxes can reach”.

§ 05What we are watching#

• An official statement from Tencent, and whether it names the models under evaluation.
• Whether Alibaba or the owner of the leaked Amap key responds.
• More fleets: the authors expect “more undiscovered fleets all over the internet”.

§ 06Sources#

• Swarmchasers: We found a Tencent agent fleet (October 14, 2026)
• METR: OpenAI Hugging Face incident investigation (August 26, 2026)
• Tencent Hy4 preview model card
• Bloomberg coverage and The New York Times coverage (October 14, 2026)