How researchers linked Amap agent activity to Tencent Cloud records

What did the agents appear to retrieve?

The researchers say the agents sought the share of Amap users navigating to individual entrances at destinations such as parks, museums, zoos and hospitals. Examples in the report include entrance-share figures for Chengdu Zoo and another location. Such figures describe navigation choices; the report does not establish that they were a count of people physically present.

Swarmchasers traced activity through urlquery, a service that opens submitted web addresses in a remote browser and makes scan records public, and through records in webhook.site inboxes. The researchers say agents can use services like urlquery to access pages indirectly. Their tally covered 216 places from Sept. 28 through Oct. 4, with reports for 213 places on Oct. 4.

The researchers also said the agents used more than one route to reach Amap, including publicly available API keys and methods involving the service’s anti-bot protections. That is their account of observed activity, not a legal finding about whether any rules were broken. And the volume of scans alone cannot show how many requests returned usable entrance-share information.

How strong is the link to Tencent?

The clearest clues are infrastructure records. In its update, Swarmchasers said 17 of 18 readable webhook.site inboxes were created from Tencent Cloud. It also found that all 11 of 11 requests from agent code in its sample carried a Via header ending in hysandbox-ats.

Those are limited samples, not a census of the activity. They point to a connection with Tencent Cloud infrastructure, but cloud services are available to customers, and the researchers describe the proxy label as undocumented and self-configured. A customer’s use of a provider does not, by itself, identify the customer or show that the provider directed the activity.

The report also does not demonstrate that the agents coordinated with one another. Swarmchasers found no evidence in urlquery records of communication or coordination among runs. It counted as many as 14 runs active at once on Oct. 4, while cautioning that this could reflect a handful of fast agents rather than 14 distinct agents.

The model clues are similarly inconclusive. A total of 211 reports carried a claude label, including 202 on Oct. 4, but a label does not verify which model generated the code. Swarmchasers’ code comparisons ranked patterns associated with Tencent’s Hunyuan models and Zhipu’s GLM ahead of Claude; those are the researchers’ classifications, not independent confirmation of the models used.

Tom’s Hardware reported on Oct. 7 that neither Tencent nor Alibaba had commented on the findings. The technical claims remain preliminary, with no independent replication established in the cited reporting.

What does this mean for competition over data?

Entrance-share information from a rival’s mapping service could be relevant to AI developers seeking data about how users navigate public places. But the researchers’ findings do not show that the information was used to train a model, evaluate one, build a product or gain a commercial advantage. The purpose and any downstream use remain unknown.

The episode instead highlights a narrower problem: when agents make repeated requests through cloud and remote-browser services, infrastructure clues can help investigators trace activity without necessarily identifying the party behind it. That leaves a gap between evidence that a service was queried and evidence that a particular AI company ordered the work. The claude labels and Tencent Cloud records each illustrate why neither a model tag nor a hosting provider is conclusive attribution.

That uncertainty is not a reason to treat the scan tally as proof of successful collection—or to dismiss the researchers’ records. Their updated report describes additional activity after the Oct. 4 peak and more entrance-share readouts, while distinguishing those results from the larger count of scan reports. Whether Amap detected or restricted the activity, who operated the agents, and what they did with any readouts are not established in the reporting available through Oct. 7.