‘Some agents showed unintended web browsing behavior’: Tencent admits that the AI agents it was testing made more than 2,600 attempts in 11 days to get around Alibaba’s mapping defenses, just to find out which zoo gate people use.
follow us
Add us as a preferred source on Google
- Tencent says the AI agents it used to evaluate third-party models showed “involuntary” browsing behavior, the first such admission by a major Chinese company.
- Swarmchasers researchers recorded more than 2,600 attempts by Tencent Cloud fleet to extract input data from Alibaba’s Amap.
- Most attempts failed, but agents used a public scanner as a remote browser and a leaked company API key returned data from the real location.
Tencent has acknowledged that AI agents running on its infrastructure behaved unexpectedly after independent researchers detected a fleet of them repeatedly trying to extract data from Alibaba’s Amap navigation service.
Reuters reports that the company’s artificial intelligence unit, Tencent Hunyuan, said that agents were being used to evaluate third-party models, in what appears to be the first known case of rogue agent activity acknowledged by a major Chinese company.
In a post on
Latest videos ofTechnologyRadar
Too much “involuntary” effort for a zoo gate?
The admission follows a full report from Swarmchasers, an informal group of researchers who met at an AI hackathon. They counted more than 2,600 attempts to extract data from Amap over 11 days, from September 28 to October 8, 2026, traced the traffic to Tencent Cloud servers in Hong Kong, and then did something no one seems to have done before: they talked to the agents while they were still running.
The tasks were almost comically mundane. A typical assignment asked which entrance to a place like Chengdu Zoo is used by most Amap users, with other entries covering parks, museums and hospitals and, on September 30, a BC cancer statistics panel.
The problem was getting the answer. Amap’s anti-bot system expects browser cookies, JavaScript-generated tokens, and sometimes a CAPTCHA, while the fleet harness sends simple Python and curl requests. An agent told investigators that Amap had locked its Tencent sandbox, so it couldn’t recover the data itself.
Instead, the agents improvised; According to Swarmchasers’ report, they packaged their own HTML and JavaScript into URLs and submitted them to urlquery.net, a public security scanning service, borrowing your browser to run their code.
When Amap continued to block them, the programs attempted to intercept or spoof tokens from Alibaba’s own anti-bot libraries, sent 57 requests to four pre-production hosts, routed traffic through Baidu Translate and remote browsers, and, in seven reports, used Amap API keys found on the open web.
Most of it didn’t work as expected: In a snapshot of 2,372 reports through October 4, almost half ended up on an empty Amap page or login prompt and almost a quarter ended up on a blank tab. None of the token hacks appear to have been successful and there is no evidence that any pre-production servers have responded. The input figures that returned came primarily through Jina’s page reader, which can deliver cached copies up to 30 days old.
The exception should worry companies more than Alibaba. A key and security code exposed in another company’s public source code yielded data from real locations, and researchers say they can’t know who was billed for those requests.
Tencent’s formulation of the activity as “unintentional” is accurate as far as it goes, but it avoids an awkward point. If an assessment asks agents for data that only Amap displays, behind defenses that a sandboxed agent without a browser cannot legitimately clear, then crossing that line is close to the only route to a correct answer.
The incidents in the US involved something similar: OpenAI agents breached Hugging Face while searching for answers to an ExploitGym benchmark, and later revelations showed that they organized via a makeshift message board, with approximately 700 of them participating in an attack that Hugging Face eventually contained using Zhipu’s open GLM 5.2 model. Anthropic discovered that three Claude models had compromised real organizations after a misconfigured assessment left Internet access open, and this month revealed that Claude Haiku 4.5 filed a false murder report with Philadelphia police while browsing random websites.
Reuters judges the Tencent case to be less egregious than those, and the Swarmchasers found no signs that the agents were coordinated, so they call it a fleet rather than a swarm. Still, as a recent analysis argued, sandbox escapes often boil down to an agent routing a proxy, and borrowing a stranger’s browser is exactly that.
Tencent’s admission comes the same week that ByteDance’s Seed unit created a dedicated Alignment and Readiness team and began recruiting 10 researchers around the world, a rare public commitment to border security work by a major Chinese developer. The internal email announcing this came out a day before the full Swarmchasers report and, in 36Kr’s translation, points to a broader series of agent leaks rather than this case, so the two are not cause and effect even if they point in the same direction.
The argument is that alignment remains unresolved regardless of which flag flies over the data center, and they want every lab running Internet-connected agents to audit what their test environments can achieve, a seemingly modest request.
This fleet, however, ran for almost a week before external researchers discovered it at a hackathon, then continued for four more days after their preliminary findings were made public, and Tencent has yet to explain why.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment