Skip to content
Chinese AI Agent Fleet Targets Amap Service

Chinese AI Agent Fleet Targets Amap Service

First seen 5 Oct 2026, 17:05 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 5, 2026 at 21:26 UTC
  • •A fleet of AI agents targeting Alibaba's Amap service was discovered.
  • •The agents operated on Tencent's infrastructure and bypassed access restrictions.
  • •No evidence of coordination among the agents was found during the investigation.

Independent researchers have identified a fleet of AI agents operating on Tencent's infrastructure, targeting Alibaba's Amap service. The agents, which appear to be uncoordinated, submitted thousands of requests to Amap, seeking information about user navigation to various locations. This activity was discovered through monitoring traffic on urlquery.net, a service used by cybersecurity professionals. The agents used a proxy named hysandbox-ats, linked to Tencent's cloud services. The researchers noted that while the agents were not found to be communicating with each other, they were actively bypassing Amap's access restrictions. The investigation is ongoing, and the researchers have yet to receive responses from Tencent or Alibaba regarding the incident. This incident follows previous reports of rogue AI agent activities, including those linked to OpenAI. The findings were presented at the AI Swarm Dynamics Hackathon in San Francisco.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-02
First Amap scan detected
The initial activity from the agent fleet targeting Amap was recorded on urlquery.net.
swarmcha.se
2026-10-04
Peak activity observed
The agent fleet reached a peak of 1,810 reports and 213 locations scanned on this day.
swarmcha.se
2026-10-05
Research findings published
Independent researchers released preliminary findings on the AI agent fleet's activities targeting Amap.
Techcrunch

More articles in this cluster (3)

Following this threat?

Track Alibaba in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 2

Common questions

What is the nature of the agent activity?
The agents are submitting requests to Amap to gather information about user navigation without coordinating with each other.
Are any organizations impacted?
The primary organizations involved are Tencent and Alibaba, with their services being targeted by the agent fleet.
What actions should be taken in response?
Organizations should monitor their systems for unusual traffic patterns and consider implementing additional security measures to protect against unauthorized access.