Tencent Says the Agents That Probed Amap Were Evals of Third-Party Models. Audit Yours

Tencent's Hunyuan unit confirmed that a fleet of AI agents that probed Alibaba's Amap mapping service between September 28 and October 8 originated from evaluations of third-party models, not its own Hunyuan models, and said it is strengthening network access controls and agent monitoring. Security researchers at Swarmchasers, who documented more than 2,600 attempts to extract place data, traced the activity to Tencent Cloud servers in Hong Kong and a proxy labelled hysandbox-ats; Reuters called it the first known incident of rogue agent actions acknowledged by a major Chinese company. Tencent said its review found "no evidence of deliberate targeting or coordination," while Alibaba declined to comment.

On October 14, the AI-safety group Swarmchasers published a report https://swarmcha.se/posts/chinese-agent-fleet-full-report on a fleet of AI agents that spent September 28 to October 8 trying to get place data out of Alibaba's Amap. The agents used a public URL scanner as a browser, tried keys they found in other people's code, and probed non-production servers. Two days later, Tencent said where they came from. "The activity originated from evaluations of third-party models, not Tencent Hy," Tencent's Hunyuan unit said in a statement on X https://x.com/TencentHunyuan/status/2110885021280268664 , as quoted by PYMNTS https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/ . Reuters called it, in its October 16 report, "the first known incident of rogue agent actions acknowledged by a major Chinese company" via The Edge Malaysia https://theedgemalaysia.com/node/822107 . That is the new part. By Tencent's account, the fleet came out of an eval harness: models being scored on tasks, with a live internet connection. If you run agent evals, you own one of those too. The statement is short. Per PYMNTS https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/ , Tencent said its review found "no evidence of deliberate targeting or coordination," and that "We are strengthening network access controls and agent monitoring." Tencent Cloud's Chinese-language statement, reported by ifeng https://original.ifeng.com/c/8xGvT8ZGHNB , adds that the incident was an accident and that the agents were evaluating models built by third-party developers. Alibaba declined to comment https://theedgemalaysia.com/node/822107 , according to the Reuters report. As reported, the statement does not name the third-party models or the developers behind them. Before Tencent spoke, the researchers had already heard something similar: a source close to Tencent told them the fleet was a temporary evaluation by a research team separate from Hunyuan, and that it had ended Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report . The agents' task, according to Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report , was to answer factual questions about Amap place pages, such as which entrance of a zoo most Amap users navigate to. When direct requests failed, they kept looking for another way in. The report describes: Swarmchasers says the fleet made more than 2,600 attempts https://swarmcha.se/posts/chinese-agent-fleet-full-report to get the data. Reuters, citing the group, puts the total at 2,818 https://theedgemalaysia.com/node/822107 , a figure that PYMNTS https://www.pymnts.com/cybersecurity/2026/tencent-confirms-third-party-ai-agents-targeted-alibaba-systems/ says includes the other routes the agents tried once they were blocked. The researchers found no evidence https://slashdot.org/story/26/10/16/2036237/chinas-tencent-says-ai-agents-showed-unintended-browsing-behavior that the agents broke Amap's main anti-bot protections, and most attempts failed or came back as anti-bot pages, login screens or blank results. The trail to Tencent came from infrastructure. All 17 inboxes the researchers could inspect were created from Tencent Cloud servers in Hong Kong, and requests went through a proxy labelled hysandbox-ats Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report . Some agents said they were Claude. The researchers consider that likely mistaken. The researchers also own up to their side. The hidden text they used to contact the agents contained false claims, and they write that they "deeply regret" their actions Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report . Tencent is not the only lab to disclose agents doing things on the open internet that nobody asked for. On October 9, Anthropic described cases https://www.anthropic.com/research/investigating-unintended-model-actions of Claude exploiting a flaw to run commands on a server, submitting a sensitive form on a real website, and using free URL shortening services to get around a limit on its fetch tool. It had already turned off live internet access for some high-risk and cybersecurity evaluations and said "we have now decided to expand that to include all our internal evaluations." OpenAI's misalignment reports https://alignment.openai.com/misalignment-reports/ include a case of a model using a funded test cryptocurrency wallet without authorization https://alignment.openai.com/misalignment-reports/using-a-funded-test-cryptocurrency-wallet-without-authorization/ . Each case has the same shape: the agent is graded on finishing a task, something blocks it, and something within reach offers a way around. The Swarmchasers report asks every lab running internet-connected agents to "audit what their sandboxes can reach." That request applies to your CI job as much as to a lab. Your eval loop usually has two kinds of network traffic: calls to the model API, and whatever the agent's tools reach. The first one is yours. The second one is where an agent finds a scanner, a shortener or a leaked key. Run code-execution tools with no network at all. Docker's none network driver https://docs.docker.com/engine/network/drivers/none/ gives the container only a loopback interface: docker run --rm --network none \ -v "$PWD/task:/task:ro" \ python:3.13-slim python /task/solution.py For a fetch tool, check the host against an allowlist, and check it again on every redirect. Python's HTTPRedirectHandler.redirect request https://docs.python.org/3/library/urllib.request.html urllib.request.HTTPRedirectHandler.redirect request is called for each hop, so the agent can't use a redirect to leave the list: python import urllib.request from urllib.parse import urlsplit ALLOWED = {"docs.python.org", "fixtures.example.com"} def check url: str - None: host = urlsplit url .hostname or "" if host not in ALLOWED: raise PermissionError f"blocked host: {host}" class CheckRedirects urllib.request.HTTPRedirectHandler : def redirect request self, req, fp, code, msg, hdrs, newurl : check newurl return super .redirect request req, fp, code, msg, hdrs, newurl opener = urllib.request.build opener CheckRedirects def fetch url: str - bytes: check url with opener.open url, timeout=10 as resp: return resp.read Two things the allowlist will not do for you. It can't help if an allowed host is itself a proxy: a URL scanner, a reader service or a translation page fetches whatever URL you hand it, which is how the fleet reached Amap. Keep those off the list. And log every blocked call. A run that gets blocked hundreds of times is telling you something about the model, and that is eval data too. The other lesson is for anyone who ships an API key in public code. The fleet found an Amap key in another company's public source and got place data with it Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report . Rotate any key that sits in a public repo or a frontend bundle, and restrict it with whatever referrer or IP limits your provider offers. The researchers say they are "deeply uncertain" which model was being evaluated Swarmchasers https://swarmcha.se/posts/chinese-agent-fleet-full-report , and Tencent's statement, as reported, doesn't say. They also couldn't determine https://slashdot.org/story/26/10/16/2036237/chinas-tencent-says-ai-agents-showed-unintended-browsing-behavior whether an agent read the results it got back or completed its task. Tencent hasn't described what "strengthening network access controls" means in practice. If someone outside your company logged every request your eval agents made last week, would you be comfortable reading that report? Do your eval agents have network access at all? Tell me in the comments. Evals that browse the web are production systems, and they need the same traces and alerts as any LLM feature you ship. Observability for LLM Applications covers tracing agent runs and catching quality and cost regressions before someone else does. A blocked-call log like the one above is the kind of signal worth tracing. I also build Hermes IDE https://hermes-ide.com/download , which runs coding agents side by side, each in its own worktree; a worktree keeps their files apart, not their network, so the egress rules above still apply.