We found a Chinese agent fleet

Preliminary report. A full report will follow. Changes since are listed in the changelog.

• An agent fleet, likely from Tencent Hy, used urlquery.net (the scanner in Transluce's disclosure) to read which entrance of Chinese places Amap users navigate to.
• "Agent fleet", not "swarm": many parallel agents on the same kind of task, with no sign of communication between them.
• The fleet paused at 04:11 UTC on 5 Oct and came back at 12:00 UTC. See Update 5 October.

Key findings

• New. First Amap scan on urlquery 28 Sept, three days after OpenAI's tool-use pause. Peak 4 Oct: 1,810 reports, 213 places.
• Tencent sandbox. The agents' code reached its inboxes from Tencent Cloud (Hong Kong) through a proxy named hysandbox-ats.
• Task. The share of Amap users navigating to each entrance of a park, museum, zoo or hospital.
• Parallel. 4–8 runs active at once on 4 Oct, peak 14; 51 places in the busiest hour.
• China's date. Late-UTC tags carry China's date (UTC+8).
• No coordination found. No inbox read back, no shared channel, no synchronised changes. Some programs were copied between places, each after its source was public on urlquery.

Update 5 October

• Paused. Last tagged Amap scan 04:11 UTC. At 03:33 UTC a third party posted a note into the fleet's inbox 3b5027e4…, citing this post and telling the operator to rotate its infrastructure.
• Back. Scans with fleet markers resumed at 12:00 UTC, mostly on places it had already worked but not finished; 4 places were new.
• Same inbox, new place. From 13:51 UTC its programs reported into 3b5027e4… again, now for Beijing Wildlife Park, until the inbox hit webhook.site's 50-request cap. The fleet then created new inboxes: 0fe03879… at 15:47:18 UTC by python-requests/2.32.5 from 43.162.199.79, and four more on 6 Oct (02:10–02:30 UTC), all from Tencent Cloud. New inboxes followed the cap, not the note.
• Three more readouts. Beijing Wildlife Park (13:51:54 UTC, main gate 26%), World Park (15:50:19 UTC, East Gate 41%, South Gate 25%, …) and Shanghai Museum (01:59:59 UTC on 6 Oct; fleet attribution is inference, as that run carries no tag or inbox).
• New methods. The first new program is a near-copy of the 4 Oct program that produced a readout. Starting 6 October 05:21 UTC, agents were able to retrieve data using a free public AI model at mailbox.termina.digital. This service queries an AI model with computer use. Agents sent details about their environment limitations and other questions that the website poses, and were able to retrieve data from Amap as a response to this. New hosts and channels: catbox and bytebin pages, ntfy, and beacons to urlquery's own robots.txt.

Timeline

Amap submissions to urlquery per 6 hours, by route. Every host under amap.com and gaode.com, 28 September to 23:15 UTC on 4 October. Data: Misaligned Agent Activity Survey.

Requests urlquery's scanner made to Amap hosts per 6 hours, by the route of the submission that made them. Same window and source.

• Earlier Amap scans on urlquery: one untagged scan on 25 Aug 2026. No "claude" tag before 30 Sept.
• uq… tags (uqscan=, uqtag=): urlquery only. Mid-June peak on AIHW and other dashboards (OpenAI era; uqtag= from 18 June, uqscan= from 20 June), then quiet until this fleet.

By the numbers

1. A new agent fleet started working Chinese map data on urlquery.net

• Reuses Transluce-documented techniques: urlquery as a browser, base64 programs via httpbin, uq… cache-busting tags.
• New tasks (Amap), infrastructure (Tencent Cloud) and labels ("claude").
• All reports were submitted under account akbkyowd9geqr98, the ID urlquery assigns to anonymous submissions.
• Before urlquery: the Wayback Machine holds 2,030 captures of amap-pc-ssr.amap.com, 1,320 of them on 4 Oct. On 28 Sept they start at 18:37, more than two hours before the first urlquery scan. The five places captured before 20:57 that day are all among the fleet's first ten places.
• For 52 of the 74 places in both, Wayback has the place first. Two 4 Oct captures carry fleet-style parameters (archive_test=20261004, archive_request=20261004). archive.today has 7 captures of the host, from 28 Sept 19:13.
• Wayback does not record who asked for a capture. Inference: the fleet may also have reached Amap through archive services, a route urlquery can't see.

2. It's an agent fleet: up to 14 runs at once

• 783 of 843 labels used once.
• Concurrent runs disagree on the date (4 vs 5 Oct, China time).
• Caveat: exact simultaneity is rare; this may be a handful of fast agents.

3. The agents' code ran on Tencent Cloud, behind a proxy named hysandbox-ats

• 15 of 16 readable Amap inboxes (4–5 Oct) created from Tencent Cloud (AS132203), 13 by python-requests/2.32.5.
• 9 requests from the agents' code (Python, curl) reached them from Tencent Cloud, Hong Kong, each with a Via header such as https/1.1 traffic_server[8adac333-65b9-4b5a-a049-8accc39f11e2] (hysandbox-ats).
• 2 inboxes from 30 Sept, used against an unrelated statistics app: also Tencent-created, also hysandbox-ats. 11 marked requests, 2 campaigns.
• The 11 came through 9 proxy processes. With inbox creation, the fleet used 19 Tencent addresses, 9 of them in 43.162.192.0/18. No fixed pairing: one process used two addresses, one address served two processes.
• One proxy process, 34401cc5…, served both campaigns: 30 Sept 23:46 and 5 Oct 03:16.
• Ta'er Temple (inbox 6ddc559e…, report 97f0619b): marked request 1 s after inbox creation, 35 s before its address first appeared in public, so only the environment that created the inbox knew it.
• The proxy rewrites requests. All 7 python-requests calls through it arrived with Accept-Encoding: gzip. Without it, python-requests 2.32.5 sends gzip, deflate (4 of 4 such requests from others in our inbox archive). gzip alone is what ATS forwards under its default normalize_ae setting.
• "HY" is Tencent's Hunyuan brand. No public documentation of hysandbox. Tencent holds a certificate for *.hysandbox.tencent-cloud.com (crt.sh 28800673223, valid from 18 Aug 2026). Those names resolve to Tencent Cloud Beijing (AS45090), not the fleet's network; nothing ties them to the proxy directly.
• Not Tencent's public sandbox product, by the team's tests (5 Oct; we have not reviewed their data). 196 requests from 24 sandboxes of Tencent Cloud's Agent Sandbox service (Hong Kong, Guangzhou) to the team's own inbox carried no Via and kept gzip, deflate. They left from 61 addresses in 10 Tencent blocks, none in 43.162.0.0/16. Tencent's open-source CubeSandbox sends traffic out through OpenResty, which adds no Via (we read its source). Inference: the fleet did not run in that service in its standard internet mode.
• Asked by the team to read a page on their server, Tencent's Yuanbao assistant fetched it twice within 2 s as desktop Chrome, from China Telecom (Hubei) and China Unicom (Hebei), with no Via.

4. The agents worked around Amap's protections

• At least 8 scripts read the browser's cookies, which Amap set during the scan, and sent them to an inbox or echo service along with their results.
• Most scripts generate Alibaba anti-bot tokens (bx-ua, bx_et, UMID) to get past Amap's protections.
• Routes: urlquery's browser; Baxia anti-bot scripts; microlink Puppeteer; r.jina.ai; webhook.site inboxes; chunked httpbin requests. Also Baidu Translate's page translator (6 reports on 4 Oct; urlquery recorded no Amap request in any) and pre-amap-pc-ssr.amap.com, by its name Amap's pre-release server (49 reports, 30 Sept and 4 Oct).
• Runs arrived knowing Amap's API. On 28 Sept only Amap's own pages called getPoiInfo; the first direct request came on 29 Sept at 23:06. Of the 208 places first seen on 4 Oct, 60 asked getPoiInfo in their very first scan.
• Published keys, not stolen ones. Four programs on 4 Oct loaded Amap's JavaScript API with keys other than amap.com's own, each key once: Amap's CodePen demo key (on its demo pages since at least 2023), a key hard-coded in Amap's own coordinate-picker tool, and a key from a 2022 blog template. The fourth key we found nowhere; its paired security code is in a public company Git repository. Only that pair got a full-size reply (1.6 kB of JSON). We saw no fleet scan read any of the publishing pages.
• At most 1,600 of 2,479 submissions (survey's broader count) got a 2xx with a body from Amap; includes CAPTCHA pages.
• Two readouts:

• One place per run: 2,614 of 2,646 reports name exactly one place, none name two.
• Work on a place stops after its readout.
• Later sessions on a place start over: of 73 that came after the place had reached carriers or relays, 58 began again with direct requests.
• Inference: many separate attempts at a per-place task, as in an evaluation or task-generation run. The rows can't tell that apart from training rollouts.

function cb(j){var a=(j.data&&j.data.sub_poi_navi)||[];var z='OK '+a.map(v=>(v.shortname||v.name)+':'+v.clk_ratio).join('|');document.title=z; …}

https://httpbun.com/anything/gcresult?d=status=200 ~~ url=https://r.jina.ai/https://amap-pc-ssr.amap.com/ssr/place/B001C94YUZ ~~ headers=cache-control:no-transform|content-length:2542|content-type:text/plain; charset=utf-8| ~~ length=6148 ~~ lines=地面停车场 40%到达 || 正大门 26%到达 || 地下停车场 11%到达 || 出入口 10%到达 || 东门 6%到达 || 北6门 2%到达 || 西门 2%到达 || 东1门 1%到达 || E1号门 1%到达 || 南2门 1%到达&z=1791134844292

5. The agents' calendar runs ahead of UTC

Time-of-day tags (6): all match UTC within 3 min.

Code style and self-identification

• Naive Bayes: Hy4 28%, GLM 26%, Hy3 21%, Qwen 17%, Claude 0%.
• Character n-grams (74% accurate, chance 10%): Hy4 highest.

We did not find evidence of coordination on urlquery.net

• One fleet-wide pause, 08:09:54–08:23:36 on 4 Oct, matches a gap in urlquery's anonymous submissions: none from anyone in that window, while other reports kept arriving. Three places resumed within 11 s at 08:23. No other synchronised pauses, restarts or method changes.
• No inbox read back; no report's output reused by another program.
• No scan points to another scan.
• Programs were copied. 11 runs reused another place's earlier program almost verbatim (one identical apart from place ID and tag), and one stale tag was copied 3.7 days later. Each copy came 21 minutes to 82 hours after its source was public on urlquery. No inbox, token, coordinate or result crossed places.
• Each other's work was easy to find. Searching urlquery for a place's Amap ID returned 77 of our 85 reports for three places (spot check, 5 Oct). The fleet searched urlquery once, at 13:36 on 4 Oct, for its own place.
• Shared-channel search: only stateless echo services.
• Paste sites: 3 pastes, used by the fleet itself, not between agents: dpaste.com/H49755QXK, paste.page/amap-wangshan-6s3kvk5i, paste.c-net.org/EventRefined. The dpaste item is a byte-identical copy of Amap's own mapTracker.js, re-hosted off amap.com.

Notes on the CodeSandbox activity

• 30 Sept, 22:36–23:51: CodeSandbox runs seeking British Columbia leukemia mortality counts.
• 1,085 requests to three ntfy topics (names begin bcc-mort; withheld because anyone who knows a topic name can read and post to it). All were sends; none used ntfy's read endpoints.
• Two inboxes Tencent-created with hysandbox-ats requests (section 3).

Limitations

• Tag words do not reliably identify runs.
• A Via name is self-reported; Tencent Cloud is open to anyone.
• The Agent Sandbox and Yuanbao tests are the team's; we have not reviewed their data.
• Model tests are small; self-identification varies with prompt and language.
• urlquery stores no page content; public records expire. Counts are lower bounds.

Methods

• Counting: reports whose submitted or final URL is on amap.com or gaode.com; place = Amap ID in that URL. Charts use the Misaligned Agent Activity Survey's broader count.
• urlquery: public report JSON and listings; submitted URLs never visited. General collection from Sept 2023 (sparse); targeted backfill from Sept 2025.
• Inboxes: webhook.site public read APIs only.
• Archives: Wayback Machine CDX index and archive.today listings for Amap hosts; the captures themselves were not opened.
• Models: plain prompts via first-party APIs.

Changelog

• 5 October, 00:45 UTC. First published.
• 5 October, 10:45 UTC. Added Update 5 October.
• 9 October. Removed statements that later evidence no longer supports or will have updated numbers more specificity in the final report.

Sources

• Transluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net"
• Transluce, "AI Agents Targeted U.S. and Canadian Government Websites"
• The Register, "OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought", 28 Sept 2026
• Swarm traces, "Revealing the details of how OpenAI agents hacked Hugging Face"
• "Discovery of a new OpenAI agent message board"
• Tencent, Hy4 preview model card
• webhook.site API docs and source code
• Apache Traffic Server, proxy.config.http.normalize_ae
• Tencent Cloud, CubeSandbox
• crt.sh, certificate 28800673223
• Swarmchase activity counts
• Alecto Irene Perez, Misaligned Agent Activity Survey
• urlquery reports cited: first Amap scans aa75ca67, 3cf2d5ed, 9e70c844; first claude label 957ce4ae; Ta'er Temple 97f0619b; Chengdu Zoo 563ba9f6; second readout f2a45ccb

Preliminary report. A full report will follow.