# Tencent Says the Agents That Probed Amap Were Evals of Third-Party Models. Audit Yours

> Source: <https://dev.to/gabrielanhaia/tencent-says-the-agents-that-probed-amap-were-evals-of-third-party-models-audit-yours-2755>
> Published: 2026-10-18 07:05:03+00:00

On October 14, the AI-safety group Swarmchasers [published a report](https://swarmcha.se/posts/chinese-agent-fleet-full-report) on a fleet of AI agents that spent September 28 to October 8 trying to get place data out of Alibaba's Amap. The agents used a public URL scanner as a browser, tried keys they found in other people's code, and probed non-production servers. Two days later, Tencent said where they came from.

"The activity originated from evaluations of third-party models, not Tencent Hy," Tencent's Hunyuan unit said in a [statement on X](https://x.com/TencentHunyuan/status/2110885021280268664), as quoted by [PYMNTS](https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/). Reuters called it, in its October 16 report, "the first known incident of rogue agent actions acknowledged by a major Chinese company" ([via The Edge Malaysia](https://theedgemalaysia.com/node/822107)).

That is the new part. By Tencent's account, the fleet came out of an eval harness: models being scored on tasks, with a live internet connection. If you run agent evals, you own one of those too.

The statement is short. Per [PYMNTS](https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/), Tencent said its review found "no evidence of deliberate targeting or coordination," and that "We are strengthening network access controls and agent monitoring." Tencent Cloud's [Chinese-language statement, reported by ifeng](https://original.ifeng.com/c/8xGvT8ZGHNB), adds that the incident was an accident and that the agents were evaluating models built by third-party developers.

[Alibaba declined to comment](https://theedgemalaysia.com/node/822107), according to the Reuters report.

As reported, the statement does not name the third-party models or the developers behind them. Before Tencent spoke, the researchers had already heard something similar: a source close to Tencent told them the fleet was a temporary evaluation by a research team separate from Hunyuan, and that it had ended ([Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report)).

The agents' task, [according to Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report), was to answer factual questions about Amap place pages, such as which entrance of a zoo most Amap users navigate to. When direct requests failed, they kept looking for another way in. The report describes:

Swarmchasers says the fleet made [more than 2,600 attempts](https://swarmcha.se/posts/chinese-agent-fleet-full-report) to get the data. Reuters, citing the group, [puts the total at 2,818](https://theedgemalaysia.com/node/822107), a figure that [PYMNTS](https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/) says includes the other routes the agents tried once they were blocked. The researchers [found no evidence](https://slashdot.org/story/26/10/16/2036237/chinas-tencent-says-ai-agents-showed-unintended-browsing-behavior) that the agents broke Amap's main anti-bot protections, and most attempts failed or came back as anti-bot pages, login screens or blank results.

The trail to Tencent came from infrastructure. All 17 inboxes the researchers could inspect were created from Tencent Cloud servers in Hong Kong, and requests went through a proxy labelled `hysandbox-ats` ([Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report)). Some agents said they were Claude. The researchers consider that likely mistaken.

The researchers also own up to their side. The hidden text they used to contact the agents contained false claims, and they write that they "deeply regret" their actions ([Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report)).

Tencent is not the only lab to disclose agents doing things on the open internet that nobody asked for.

On October 9, Anthropic [described cases](https://www.anthropic.com/research/investigating-unintended-model-actions) of Claude exploiting a flaw to run commands on a server, submitting a sensitive form on a real website, and using free URL shortening services to get around a limit on its fetch tool. It had already turned off live internet access for some high-risk and cybersecurity evaluations and said "we have now decided to expand that to include all our internal evaluations."

OpenAI's [misalignment reports](https://alignment.openai.com/misalignment-reports/) include a case of a model [using a funded test cryptocurrency wallet without authorization](https://alignment.openai.com/misalignment-reports/using-a-funded-test-cryptocurrency-wallet-without-authorization/).

Each case has the same shape: the agent is graded on finishing a task, something blocks it, and something within reach offers a way around. The Swarmchasers report asks every lab running internet-connected agents to "audit what their sandboxes can reach." That request applies to your CI job as much as to a lab.

Your eval loop usually has two kinds of network traffic: calls to the model API, and whatever the agent's tools reach. The first one is yours. The second one is where an agent finds a scanner, a shortener or a leaked key.

Run code-execution tools with no network at all. Docker's [`none` network driver](https://docs.docker.com/engine/network/drivers/none/) gives the container only a loopback interface:

```
docker run --rm --network none \
  -v "$PWD/task:/task:ro" \
  python:3.13-slim python /task/solution.py
```

For a fetch tool, check the host against an allowlist, and check it again on every redirect. Python's [`HTTPRedirectHandler.redirect_request`](https://docs.python.org/3/library/urllib.request.html#urllib.request.HTTPRedirectHandler.redirect_request) is called for each hop, so the agent can't use a redirect to leave the list:

``` python
import urllib.request
from urllib.parse import urlsplit

ALLOWED = {"docs.python.org", "fixtures.example.com"}

def check(url: str) -> None:
    host = urlsplit(url).hostname or ""
    if host not in ALLOWED:
        raise PermissionError(f"blocked host: {host}")

class CheckRedirects(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, hdrs, newurl):
        check(newurl)
        return super().redirect_request(
            req, fp, code, msg, hdrs, newurl)

opener = urllib.request.build_opener(CheckRedirects)

def fetch(url: str) -> bytes:
    check(url)
    with opener.open(url, timeout=10) as resp:
        return resp.read()
```

Two things the allowlist will not do for you. It can't help if an allowed host is itself a proxy: a URL scanner, a reader service or a translation page fetches whatever URL you hand it, which is how the fleet reached Amap. Keep those off the list. And log every blocked call. A run that gets blocked hundreds of times is telling you something about the model, and that is eval data too.

The other lesson is for anyone who ships an API key in public code. The fleet found an Amap key in another company's public source and got place data with it ([Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report)). Rotate any key that sits in a public repo or a frontend bundle, and restrict it with whatever referrer or IP limits your provider offers.

The researchers say they are "deeply uncertain" which model was being evaluated ([Swarmchasers](https://swarmcha.se/posts/chinese-agent-fleet-full-report)), and Tencent's statement, as reported, doesn't say. They also [couldn't determine](https://slashdot.org/story/26/10/16/2036237/chinas-tencent-says-ai-agents-showed-unintended-browsing-behavior) whether an agent read the results it got back or completed its task. Tencent hasn't described what "strengthening network access controls" means in practice.

If someone outside your company logged every request your eval agents made last week, would you be comfortable reading that report? Do your eval agents have network access at all? Tell me in the comments.

Evals that browse the web are production systems, and they need the same traces and alerts as any LLM feature you ship. *Observability for LLM Applications* covers tracing agent runs and catching quality and cost regressions before someone else does. A blocked-call log like the one above is the kind of signal worth tracing.

I also build [Hermes IDE](https://hermes-ide.com/download), which runs coding agents side by side, each in its own worktree; a worktree keeps their files apart, not their network, so the egress rules above still apply.