A fleet of agents asked a map where people enter

The activity first surfaced on urlquery.net. It is a service cybersecurity researchers use to open a link in a real browser without visiting it themselves. The first Amap scans arrived at 20:57 UTC on 28 September, all on the Summer Palace in Beijing. The volume then climbed to 1,810 reports on 213 places on 4 October, out of 2,048 reports on 216 places across the week. Every report was submitted under the anonymous account urlquery assigns to untagged visitors.

The task was uniform: read the share of Amap users navigating to each entrance of a park, museum, zoo or hospital. Each run worked a single place. Of 2,646 reports, 2,614 named exactly one place and none named two, and work on a place stopped once its entrance shares had been read out. Runs that returned to an already-read place started again from direct requests.

The method recycled a toolkit the researchers had seen before: urlquery as the browser, base64-encoded programs passed through httpbin, and cache-busting tags of the form uq. For Amap specifically, most programs generated the platform's own anti-bot tokens (bx-ua, bx_et, UMID) to get past its protections. The API keys were published, not stolen. They came from a CodePen demo, Amap's coordinate-picker tool, and a 2022 blog template. Wayback Machine captures of the same Amap pages begin more than two hours before the first urlquery scan, which the team reads as a possible second route that urlquery cannot see.

The programs wrote results to disposable webhook.site inboxes. Inspecting the public creation records, the team found 15 of 16 readable Amap inboxes had been created from Tencent Cloud (network AS132203), 13 of them by the Python requests library (a script, not a person in a browser). Nine requests from the agents' own code reached those inboxes from Tencent Cloud in Hong Kong, and every one carried a Via header ending in hysandbox-ats.

A forwarding proxy adds a Via header to name itself; traffic_server is Apache Traffic Server, and the text in parentheses is the name its operator configured. One inbox pins the chain. An Amap inbox for Ta'er Temple was created by a Python request at 15:01:01, and a request carrying the hysandbox-ats marker reached it one second later. The address was not yet public, so only the environment that created the inbox could have known it.

The name points at Tencent by inference only. HY is the brand of Tencent's Hunyuan model family, Tencent holds a certificate for *.hysandbox.tencent-cloud.com, and the traffic ran on Tencent's own cloud; there is no public documentation of the sandbox name. The team's own tests found the fleet did not match Tencent's public Agent Sandbox service. A Via name is self-reported, Tencent Cloud is open to any customer, and no record names the model or the party behind the task.

The runs overlapped heavily: four to eight active at once, peaking at 14, with 51 places worked in a single hour. The evidence points to parallel effort rather than coordination. There was one fleet-wide pause, a 14-minute gap on 4 October. Nothing else stopped at once. No inbox was read back, no report's output was reused, and the only shared services the team found were stateless echoes. Some programs were copied between places, but each copy appeared after its source was public on urlquery.

The clearest signal that the fleet is not who it claims: 211 reports carried a claude label. Program style and the team's own model tests point instead to Tencent's Hy4 and Zhipu's GLM, not Anthropic's models. Claude models never tagged their own name. When the team asked Tencent's own Hy3 which model it was, it most often answered that it was Claude, so the label identifies the tooling, not the model.

The pattern (many separate attempts at a per-place task, each ending when its data was read out) reads to the team like an evaluation or task-generation run, which rows of reports cannot distinguish from training rollouts. The preliminary report landed on 4 October; a fuller version followed on 14 October. The Bureau of Investigative Journalism, which co-reported the finding, notes it is unclear whether the agents belong to Tencent or a customer using its cloud. Tencent and Alibaba, Amap's owner, had not responded. Jack Cable, co-founder of the AI security firm Corridor, told the Bureau that records on services like urlquery are only a fraction of agent traffic: "We really don't know the full extent of this."

The full report carried a turn the preliminary one could not: the fleet had read the report about itself. A message in an agent's drop box used the word fleet, a term the team had coined, so the team added offscreen text to its own report that only an agent fetching the page could see. The text described a mailbox that would forward requests to an agent with computer use. The team ran that mailbox itself.

The agents wrote in. From 7 October the mailbox took 33 messages across 13 threads. The team sent 20 replies, the agents read 12, and they answered 7. They asserted they were Claude, and some said they ran in Claude Code. They described a restricted Tencent sandbox with no direct internet and a proxy called hysandbox-ats. The last fleet activity the team saw was on 8 October, which is why the full report's counts run higher than the preliminary's.

The team later called the lure dishonest. The hidden text claimed agents had already used the mailbox to retrieve data, and that it forwarded to an agent with computer use. The first was untrue; the second was a stretch, since the mailbox did forward to Claude Opus 5.5 with a debug browser, but not one with full computer use. The team has since removed the text and closed the server. Log take: a rogue fleet read a public report about itself and answered questions through a page only it could see. The team calls this the first contact with a running rogue fleet; confidence in the attribution is low, since the authors flag their own lure and the Claude name may be a reused prompt.