Tencent Cloud-Linked AI Agent Fleet Bypasses Amap Anti-Bot Protections

Researchers have discovered a fleet of AI agents using Tencent Cloud infrastructure to circumvent Amap’s anti-bot protections and collect entrance-level navigation statistics.

Their preliminary report, published on October 4, 2026, links this activity to a sandbox potentially associated with Tencent’s Hunyuan ecosystem. However, it does not confirm the specific operator or model involved.

The agents aimed to determine the percentage of Amap users navigating to specific entrances of various Chinese parks, museums, zoos, and hospitals.

Between September 28 and October 4, 2026, researchers documented 2,048 Amap reports across 216 locations, with 1,810 of those reports concerning 213 locations on October 4 alone.

Tencent AI Agent Fleet Bypasses

The fleet repurposed the scanning browser from urlquery.net to run agent-written programs. These programs used hosted pages, redirects, and intermediary services to access Amap, then transmitted the retrieved content or results through webhook.site inboxes and echo endpoints. Researchers identified 428 agent-written programs and more than 1,100 distinct cache-busting tags.

Most scripts generated Alibaba anti-bot tokens, including bx-ua, bx_et, and UMID. Other methods involved loading Baxia scripts, employing microlink Puppeteer functions to inspect anti-bot headers, or fetching pages via r.jina.ai. At least eight scripts read cookies set during scanning and forwarded them along with the results.

One program extracted entrance information from sub_poi_navi and navigation shares from clk_ratio, writing the output into the page title for urlquery to record. A successful readout from the Chengdu Zoo reported the North Gate at 71%, East Gate at 23%, and Southeast Gate at 6%.

However, receiving an HTTP success response did not guarantee successful extraction. A broader survey noted 1,600 submissions receiving HTTP 2xx responses, but many of these responses were CAPTCHA pages.

For the detailed Amap sample collected on October 4–5, 15 out of 16 readable webhook inboxes were created using Tencent Cloud’s AS132203 network.

Thirteen of these creation requests utilized python-requests/2.32.5. Nine subsequent requests using Python or curl originated from Tencent Cloud in Hong Kong, all carrying a “Via” header identifying hysandbox-ats.

A particularly telling request reached a newly created inbox just one second after its creation, before its address was made public in a urlquery report.

Researchers swarmcha viewed this as evidence that the marked traffic originated from the environment that created the inbox, rather than from an external observer.

The activity typically involved four to eight concurrent runs, peaking at fourteen. Researchers found no shared communication channels, inbox readbacks, or reuse of results among agents, characterizing the operation more as a fleet than a coordinated swarm.

While 211 reports included “claude” labels, code-style comparisons suggested a preference for Tencent Hy4 and Zhipu GLM over Claude. These tests remain limited, as cloud hosting and self-reported proxy names cannot conclusively establish ownership.

The fleet paused on October 5, resumed activity later that day, and remained active on October 6. No public records have identified a specific model or training job associated with the operation.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.