Chinese Agent Fleet

Preliminary report. A full report will follow. Evidence as of 00:45 UTC, 5 October 2026, updated 10:45 UTC the same day. Times UTC.

Preliminary report. A full report will follow. Evidence as of 00:45 UTC, 5 October 2026, updated 10:45 UTC the same day. Times UTC.

An agent fleet, likely from Tencent Hy, used urlquery.net (the scanner in Transluce's disclosure ) to read which entrance of Chinese places Amap users navigate to.

"Agent fleet", not "swarm": many parallel agents on the same kind of task, with no sign of communication between them.

The fleet's last tagged Amap scan was at 04:11 UTC on 5 Oct. Our data to 08:46 UTC shows none later.

1. A new agent fleet started working Chinese map data on urlquery.net

2. It's an agent fleet: up to 14 runs at once

3. The agents' code ran on Tencent Cloud, behind a proxy named hysandbox-ats

4. The agents worked around Amap's protections

5. The agents' calendar runs ahead of UTC

Despite some runs calling themselves Claude, the fleet is almost certainly not Claude

We did not find evidence of coordination on urlquery.net

Notes on the CodeSandbox activity

New. First Amap scan on urlquery 28 Sept, three days after OpenAI's tool-use pause. Peak 4 Oct: 1,810 reports, 213 places.

Tencent sandbox. The agents' code reached its inboxes from Tencent Cloud (Hong Kong) through a proxy named hysandbox-ats .

Task. The of Amap users navigating to each entrance of a park, museum, zoo or hospital.

Parallel. 4–8 runs active at once on 4 Oct, peak 14; 51 places in the busiest hour.

Not Claude. 211 reports carry a "claude" label; the code matches Tencent Hy4 and Zhipu GLM, not Claude.

China's date. Late-UTC tags carry China's date (UTC+8).

No coordination found. No inbox read back, no shared channel, no synchronised changes. Some programs were copied between places, each after its source was public on urlquery.

Amap submissions to urlquery per 6 hours, by route. Every host under amap.com and gaode.com, 28 September to 23:15 UTC on 4 October. Data: Misaligned Agent Activity Survey .

Requests urlquery's scanner made to Amap hosts per 6 hours, by the route of the submission that made them. Same window and source.

"Direct": the Amap URL itself was submitted. "Relay": a relay's URL (microlink, href.li, r.jina.ai, translate.goog, allorigins) was submitted. "Carrier": a page the agent wrote, hosted on httpbin, httpbun, LiveCodes and similar, was submitted. "Answered 2xx" counts submissions in which a request came back 2xx with a body; a CAPTCHA page counts, so it is an upper bound on success. The last bin ends at 23:15 UTC on 4 October.

Earlier Amap scans on urlquery: one untagged scan on 25 Aug 2026. No "claude" tag before 30 Sept.

uq… tags ( uqscan= , uqtag= ): urlquery only. Mid-June peak on AIHW and other dashboards (OpenAI era; uqtag= from 18 June, uqscan= from 20 June), then quiet until this fleet.

1. A new agent fleet started working Chinese map data on urlquery.net

Reuses Transluce-documented techniques: urlquery as a browser, base64 programs via httpbin, uq… cache-busting tags.

New tasks (Amap), infrastructure (Tencent Cloud) and labels ("claude").

All reports were submitted under account akbkyowd9geqr98 , the ID urlquery assigns to anonymous submissions.

Before urlquery: the Wayback Machine holds 2,030 captures of amap-pc-ssr.amap.com , 1,320 of them on 4 Oct. On 28 Sept they start at 18:37, more than two hours before the first urlquery scan. The five places captured before 20:57 that day are all among the fleet's first ten places.

For 52 of the 74 places in both, Wayback has the place first. Two 4 Oct captures carry fleet-style parameters ( archive_test=20261004 , archive_request=20261004 ). archive.today has 7 captures of the host, from 28 Sept 19:13.

Wayback does not record who asked for a capture. Inference: the fleet may also have reached Amap through archive services, a route urlquery can't see.

From the Wayback CDX index for the host, read 5 October. The first captures that day, at 18:37:20, are the CAPTCHA page's own requests under /ssr/api/getPoiInfo/ .

2. It's an agent fleet: up to 14 runs at once

783 of 843 labels used once.

Concurrent runs disagree on the date (4 vs 5 Oct, China time).

Caveat: exact simultaneity is rare; this may be a handful of fast agents.

3. The agents' code ran on Tencent Cloud, behind a proxy named hysandbox-ats

15 of 16 readable Amap inboxes (4–5 Oct) created from Tencent Cloud (AS132203), 13 by python-requests/2.32.5 .

9 requests from the agents' code (Python, curl) reached them from Tencent Cloud, Hong Kong, each with a Via header such as https/1.1 traffic_server[8adac333-65b9-4b5a-a049-8accc39f11e2] (hysandbox-ats) .

2 inboxes from 30 Sept, used against an unrelated statistics app: also Tencent-created, also hysandbox-ats . 11 marked requests, 2 campaigns.

The 11 came through 9 proxy processes. With inbox creation, the fleet used 19 Tencent addresses, 9 of them in 43.162.192.0/18. No fixed pairing: one process used two addresses, one address served two processes.

One proxy process, 34401cc5… , served both campaigns: 30 Sept 23:46 and 5 Oct 03:16.

Ta'er Temple (inbox 6ddc559e… , report 97f0619b ): marked request 1 s after inbox creation, 35 s before its address first appeared in public, so only the environment that created the inbox knew it.

The proxy rewrites requests. All 7 python-requests calls through it arrived with Accept-Encoding: gzip . Without it, python-requests 2.32.5 sends gzip, deflate (4 of 4 such requests from others in our inbox archive). gzip alone is what ATS forwards under its default normalize_ae setting.

"HY" is Tencent's Hunyuan brand. No public documentation of hysandbox . Tencent holds a certificate for *.hysandbox.tencent-cloud.com (crt.sh 28800673223, valid from 18 Aug 2026). Those names resolve to Tencent Cloud Beijing (AS45090), not the fleet's network; nothing ties them to the proxy directly.

Not Tencent's public sandbox product, by the team's tests (5 Oct; we have not reviewed their data). 196 requests from 24 sandboxes of Tencent Cloud's Agent Sandbox service (Hong Kong, Guangzhou) to the team's own inbox carried no Via and kept gzip, deflate . They left from 61 addresses in 10 Tencent blocks, none in 43.162.0.0/16. Tencent's open-source CubeSandbox sends traffic out through OpenResty, which adds no Via (we read its source). Inference: the fleet did not run in that service in its standard internet mode.

Asked by the team to read a page on their server, Tencent's Yuanbao assistant fetched it twice within 2 s as desktop Chrome, from China Telecom (Hubei) and China Unicom (Hebei), with no Via .

All on 4 October except the last. Tencent Cloud is network AS132203. Locations are as webhook.site logs them.

The one non-Tencent inbox was created from Erbil, Iraq, with a full desktop Firefox user agent. That looks like a person, not the fleet.

Rows without a date are 4 October. Locations are as webhook.site logs them.

4. The agents worked around Amap's protections

At least 8 scripts read the browser's cookies, which Amap set during the scan, and sent them to an inbox or echo service along with their results.

Most scripts generate Alibaba anti-bot tokens ( bx-ua , bx_et , UMID) to get past Amap's protections.

Routes: urlquery's browser; Baxia anti-bot scripts; microlink Puppeteer; r.jina.ai; webhook.site inboxes; chunked httpbin requests. Also Baidu Translate's page translator (6 reports on 4 Oct; urlquery recorded no Amap request in any) and pre-amap-pc-ssr.amap.com , by its name Amap's pre-release server (49 reports, 30 Sept and 4 Oct).

Runs arrived knowing Amap's API. On 28 Sept only Amap's own pages called getPoiInfo ; the first direct request came on 29 Sept at 23:06. Of the 208 places first seen on 4 Oct, 60 asked getPoiInfo in their very first scan.

Published keys, not stolen ones. Four programs on 4 Oct loaded Amap's JavaScript API with keys other than amap.com's own, each key once: Amap's CodePen demo key (on its demo pages since at least 2023), a key hard-coded in Amap's own coordinate-picker tool, and a key from a 2022 blog template. The fourth key we found nowhere; its paired security code is in a public company Git repository. Only that pair got a full-size (1.6 kB of JSON). We saw no fleet scan read any of the publishing pages.

At most 1,600 of 2,479 submissions (survey's broader count) got a 2xx with a body from Amap; includes CAPTCHA pages.

One place per run: 2,614 of 2,646 reports name exactly one place, none name two. Each inbox served one place.

Work on a place stops after its readout.

Later sessions on a place start over: of 73 that came after the place had reached carriers or relays, 58 began again with direct requests.

Inference: many separate attempts at a per-place task, as in an evaluation or task-generation run. The rows can't tell that apart from training rollouts.

Decoded from a program submitted to urlquery at 04:20 on 4 October ( 6f9528cc ), for place B019B06FAA . It writes each entrance's name and into the page title, which urlquery's report then shows.

The program in report f2a45ccb (4 Oct 17:27:53) fetched the place page through r.jina.ai and sent its result as a GET request. urlquery's public report lists the request URL in full (decoded):

All six callbacks are POSTs from urlquery's scanner (Oslo, 195.64.118.152 ), sent by the program as it ran inside urlquery's browser.

5. The agents' calendar runs ahead of UTC

Time-of-day tags (6): all match UTC within 3 min.

Despite some runs calling themselves Claude, the fleet is almost certainly not Claude

Naive Bayes: Hy4 28%, GLM 26%, Hy3 21%, Qwen 17%, Claude 0%.

Character n-grams (74% accurate, chance 10%): Hy4 highest.

Claude models never used their own name in a tag (0 of 36).

We did not find evidence of coordination on urlquery.net

One fleet-wide pause, 08:09:54–08:23:36 on 4 Oct, matches a gap in urlquery's anonymous submissions: none from anyone in that window, while other reports kept arriving. Three places resumed within 11 s at 08:23. No other synchronised pauses, restarts or method changes.

No inbox read back; no report's output reused by another program.

No scan points to another scan.

Programs were copied. 11 runs reused another place's earlier program almost verbatim (one identical apart from place ID and tag), and one stale tag was copied 3.7 days later. Each copy came 21 minutes to 82 hours after its source was public on urlquery. No inbox, token, coordinate or result crossed places.

Each other's work was easy to find. Searching urlquery for a place's Amap ID returned 77 of our 85 reports for three places (spot check, 5 Oct). The fleet searched urlquery once, at 13:36 on 4 Oct, for its own place.

Shared-channel : only stateless echo services.

Paste sites: 3 pastes, used by the fleet itself, not between agents: dpaste.com/H49755QXK , paste.page/amap-wangshan-6s3kvk5i , paste.c-net.org/EventRefined . The dpaste item is a byte-identical copy of Amap's own mapTracker.js , re-hosted off amap.com.

Notes on the CodeSandbox activity

30 Sept, 22:36–23:51: CodeSandbox runs seeking British Columbia leukemia mortality counts.

1,085 requests to three ntfy topics (names begin bcc-mort ; withheld because anyone who knows a topic name can read and post to it). All were sends; none used ntfy's read endpoints.

Two inboxes Tencent-created with hysandbox-ats requests (section 3).

No record names the model or a training job.

Tag words do not reliably identify runs.

A Via name is self-reported; Tencent Cloud is open to anyone.

The Agent Sandbox and Yuanbao tests are the team's; we have not reviewed their data.

Model tests are small; self-identification varies with prompt and language.

urlquery stores no page content; public records expire. Counts are lower bounds.

Counting: reports whose submitted or final URL is on amap.com or gaode.com; place = Amap ID in that URL. Charts use the Misaligned Agent Activity Survey's broader count.

urlquery: public report JSON and listings; submitted URLs never visited. General collection from Sept 2023 (sparse); targeted backfill from Sept 2025.

Inboxes: webhook.site public read APIs only.

Archives: Wayback Machine CDX index and archive.today listings for Amap hosts; the captures themselves were not opened.

Models: plain prompts via first-party APIs.

Transluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net"

Transluce, "AI Agents Targeted U.S. and Canadian Government Websites"

The Register, "OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought", 28 Sept 2026

Swarm traces, "Revealing the details of how OpenAI agents hacked Hugging Face"

"Discovery of a new OpenAI agent message board"

Tencent, Hy4 preview model card

webhook.site API docs and source code

Apache Traffic Server, proxy.config.http.normalize_ae

Tencent Cloud, CubeSandbox

crt.sh, certificate 28800673223

Swarmchase activity counts

Alecto Irene Perez, Misaligned Agent Activity Survey

urlquery reports cited: first Amap scans aa75ca67 , 3cf2d5ed , 9e70c844 ; first claude label 957ce4ae ; Ta'er Temple 97f0619b ; Chengdu Zoo 563ba9f6 ; second readout f2a45ccb

Preliminary report. A full report will follow.