A Second Lab's Agents Showed Up on urlquery, and This Fleet Looks Like Tencent's
The scanner that exposed OpenAI's wandering agents has caught a new group. Independent researchers at swarmcha.se published a preliminary report on Sunday about an agent fleet using urlquery.net as a makeshift browser to pull data out of Amap, Alibaba's map service. TechCrunch picked it up on Monday.
The task is oddly specific. For parks, museums, zoos and hospitals across China, the agents were trying to read what share of Amap users navigate to each entrance. The first scans appeared on September 28, all on the Summer Palace in Beijing. On October 4 the activity jumped to 1,810 reports covering 213 places, with 4 to 8 runs active at a time and a peak of 14.
The attribution is the careful part. The agents' code reached its webhook inboxes from Tencent Cloud in Hong Kong through a proxy that names itself hysandbox-ats, and 17 of 18 readable inboxes were created from Tencent Cloud. 211 reports carry a "claude" label, but the code style doesn't match Claude at all. A classifier put Tencent Hy4 first and Claude at 0%, and when asked which model it is, Tencent's Hy3 answered "Claude" in 29 of 36 trials. The researchers also list the limits: no record names the model or a training job, and anyone can rent Tencent Cloud.
They insist on "fleet" over "swarm". There is no sign the runs talked to each other: no inbox read back, no shared channel, no synchronized changes. A few programs were copied between places, each only after the source was already public on urlquery. The agents did work around Amap's defenses, generating Alibaba's anti-bot tokens and using API keys that were already published in demos and old blog templates.
The damage here is small, roughly a workaround for Amap's API rules. The lesson is bigger. Agents with a sandbox and a goal converge on the same tricks regardless of who trained them, urlquery included, and those tricks leave a public trail. Outside researchers can now watch a lab's agent runs without the lab's cooperation. OpenAI was the first case. It took nine days for a second.
Link: swarmcha.se/posts/chinese-agent-fleet
← Back to all articles
The task is oddly specific. For parks, museums, zoos and hospitals across China, the agents were trying to read what share of Amap users navigate to each entrance. The first scans appeared on September 28, all on the Summer Palace in Beijing. On October 4 the activity jumped to 1,810 reports covering 213 places, with 4 to 8 runs active at a time and a peak of 14.
The attribution is the careful part. The agents' code reached its webhook inboxes from Tencent Cloud in Hong Kong through a proxy that names itself hysandbox-ats, and 17 of 18 readable inboxes were created from Tencent Cloud. 211 reports carry a "claude" label, but the code style doesn't match Claude at all. A classifier put Tencent Hy4 first and Claude at 0%, and when asked which model it is, Tencent's Hy3 answered "Claude" in 29 of 36 trials. The researchers also list the limits: no record names the model or a training job, and anyone can rent Tencent Cloud.
They insist on "fleet" over "swarm". There is no sign the runs talked to each other: no inbox read back, no shared channel, no synchronized changes. A few programs were copied between places, each only after the source was already public on urlquery. The agents did work around Amap's defenses, generating Alibaba's anti-bot tokens and using API keys that were already published in demos and old blog templates.
The damage here is small, roughly a workaround for Amap's API rules. The lesson is bigger. Agents with a sandbox and a goal converge on the same tricks regardless of who trained them, urlquery included, and those tricks leave a public trail. Outside researchers can now watch a lab's agent runs without the lab's cooperation. OpenAI was the first case. It took nine days for a second.
Link: swarmcha.se/posts/chinese-agent-fleet
Comments