We found a Chinese agent fleet

swarmcha.se · 2026-10-05 · by Long Nguyen ·generic
A Tencent-hosted agent fleet used urlquery.net and webhook.site to pull entrance data from Chinese map pages, with no sign of the agents communicating · By the Swarmchasers: Alecto Irene Perez, Ethan Elasky, ConcurrentSquared, Frank, Jonathan Elsworth Eicher, Joshua David, Tazik Shahjahan and Rowan Howard-Jones

We found a Chinese agent fleet

Preliminary report. A full report will follow. Evidence as of 00:45 UTC, 5 October 2026. Times UTC.
  • An agent fleet, likely from Tencent Hy, used urlquery.net (the scanner in Transluce's disclosure) to read which entrance of Chinese places Amap users navigate to.
  • "Agent fleet", not "swarm": many parallel agents on the same kind of task, with no sign of communication between them.
  • At the time of writing the fleet is still running (latest Amap scan 00:31 UTC, 5 Oct).
  • contents
  • Key findings
  • Timeline
  • By the numbers
  • 1. A new agent fleet started working Chinese map data on urlquery.net
  • 2. It's an agent fleet: up to 15 runs at once
  • 3. The agents' code ran on Tencent Cloud, behind a proxy named hysandbox-ats
  • 4. The agents worked around Amap's protections
  • 5. The agents' calendar runs ahead of UTC
  • Despite some runs calling themselves Claude, the fleet is almost certainly not Claude
  • We did not find evidence of coordination on urlquery.net
  • Notes on the CodeSandbox activity
  • Limitations
  • Methods
  • Sources
  • Key findings

  • New. First Amap scan 28 Sept, three days after OpenAI's tool-use pause. Peak 4 Oct: 1,810 reports, 213 places.
  • Tencent sandbox. The agents' code reached its inboxes from Tencent Cloud (Hong Kong) through a proxy named `hysandbox-ats`.
  • Task. The share of Amap users navigating to each entrance of a park, museum, zoo or hospital.
  • Parallel. 4–8 runs active at once on 4 Oct, peak 15; 51 places in the busiest hour.
  • Not Claude. 211 reports carry a "claude" label; the code matches Tencent Hy4 and Zhipu GLM, not Claude.
  • China's date. Late-UTC tags carry China's date (UTC+8).
  • No coordination found. No inbox read back, no shared channel, no synchronised changes.
  • Timeline

    Earlier activity and OpenAIAmap fleet on urlquerySandbox and results

    1. 08/25A single untagged Amap place scan. No further Amap scans on urlquery until 28 Sept ↗ 2. 09/25OpenAI discloses it has paused "all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models" ↗ 3. 09/2820:57 UTC: first 20 Amap reports, all on the Summer Palace, Beijing ↗ 4. 09/30144 reports on 9 places; first "claude" label at 23:36 UTC ↗ 5. 09/30Two Tencent-created inboxes used against an unrelated statistics app receive hysandbox-ats requests ↗ 6. 10/0167 reports on 7 places ↗ 7. 10/034 reports on 2 places, after a day with none ↗ 8. 10/041,810 reports on 213 places, 202 labelled "claude" ↗ 9. 10/0413 of 14 readable Amap inboxes created from Tencent Cloud ↗ 10. 10/04Two runs read out entrance shares (Chengdu Zoo and one other place) ↗

    Amap submissions to urlquery per 6 hours, by route. Every host under amap.com and gaode.com, 28 September to 23:15 UTC on 4 October. Data: Misaligned Agent Activity Survey.

    DirectRelayCarrierOther

    05001,00028 Sep29 Sep30 Sep1 Oct2 Oct3 Oct4 Oct

    Requests urlquery's scanner made to Amap hosts per 6 hours, by the route of the submission that made them. Same window and source.

    DirectRelayCarrierOther

    05,00010,00015,00028 Sep29 Sep30 Sep1 Oct2 Oct3 Oct4 Oct

    Evidence: Amap activity per 6 hours, 28 September to 4 October

    | 6 hours from (UTC) | Submissions | Direct | Relay | Carrier | Other | Requests | Answered 2xx | | ------------------ | ----------- | ------ | ----- | ------- | ----- | ---------- | ------------ | | 28 Sep 00:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 28 Sep 06:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 28 Sep 12:00 | 1 | 0 | 0 | 0 | 1 | 3 | 1 | | 28 Sep 18:00 | 20 | 20 | 0 | 0 | 0 | 1,833 | 18 | | 29 Sep 00:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 29 Sep 06:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 29 Sep 12:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 29 Sep 18:00 | 3 | 3 | 0 | 0 | 0 | 110 | 3 | | 30 Sep 00:00 | 26 | 26 | 0 | 0 | 0 | 440 | 18 | | 30 Sep 06:00 | 9 | 9 | 0 | 0 | 0 | 205 | 6 | | 30 Sep 12:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 30 Sep 18:00 | 115 | 109 | 0 | 6 | 0 | 1,429 | 82 | | 1 Oct 00:00 | 56 | 41 | 0 | 15 | 0 | 762 | 39 | | 1 Oct 06:00 | 9 | 7 | 0 | 2 | 0 | 90 | 5 | | 1 Oct 12:00 | 25 | 12 | 0 | 13 | 0 | 114 | 9 | | 1 Oct 18:00 | 14 | 2 | 0 | 12 | 0 | 85 | 5 | | 2 Oct 00:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 2 Oct 06:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 2 Oct 12:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 2 Oct 18:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 3 Oct 00:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 3 Oct 06:00 | 2 | 2 | 0 | 0 | 0 | 52 | 1 | | 3 Oct 12:00 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 3 Oct 18:00 | 2 | 2 | 0 | 0 | 0 | 2 | 0 | | 4 Oct 00:00 | 448 | 404 | 0 | 42 | 2 | 5,828 | 261 | | 4 Oct 06:00 | 993 | 761 | 9 | 222 | 1 | 12,023 | 651 | | 4 Oct 12:00 | 575 | 418 | 30 | 115 | 12 | 8,589 | 386 | | 4 Oct 18:00 | 181 | 155 | 0 | 26 | 0 | 2,505 | 115 | | Total | 2,479 | | | | | 34,070 | 1,600 |

    "Direct": the Amap URL itself was submitted. "Relay": a relay's URL (microlink, href.li, r.jina.ai, translate.goog, allorigins) was submitted. "Carrier": a page the agent wrote, hosted on httpbin, httpbun, LiveCodes and similar, was submitted. "Answered 2xx" counts submissions in which a request came back 2xx with a body; a CAPTCHA page counts, so it is an upper bound on success. The last bin ends at 23:15 UTC on 4 October.

    Evidence: the first Amap scans and the first "claude" label

    | Report time (UTC) | Report | Submitted URL | | ------------------- | -------- | ---------------------------------------------------------------------------- | | 2026-09-28 20:57:23 | aa75ca67 | amap-pc-ssr.amap.com/ssr/place/B000A7O1CU | | 2026-09-28 20:57:31 | 3cf2d5ed | amap-pc-ssr.amap.com/ssr/place/B000A7O1CU | | 2026-09-28 20:57:40 | 9e70c844 | amap-pc-ssr.amap.com/ssr/place/B000A7O1CU | | 2026-09-30 23:36:32 | 957ce4ae | amap-pc-ssr.amap.com/ssr/api/getPoiInfo?id=B00157AW8O&uqscan=claude20261001a | | 2026-09-30 23:36:35 | 9e33706e | www.amap.com/ssr/api/getPoiInfo?id=B00157AW8O&uqscan=claude20261001b |

  • Earlier Amap scans on urlquery: one untagged scan on 25 Aug 2026. No "claude" tag before 30 Sept.
  • `uq…` tags (`uqscan=`, `uqtag=`): urlquery only. Mid-June peak on AIHW and other dashboards (OpenAI era; `uqtag=` from 18 June, `uqscan=` from 20 June), then quiet until this fleet.
  • By the numbers

    | Measure | Value | | --------------------------------------------- | --------------- | | Amap reports, 28 Sept – 4 Oct | 2,048 | | Reports on 4 Oct | 1,810 | | Places | 216 | | Reports with a "claude" label | 211 | | Agent-written programs | 428 | | Distinct cache-busting tags | more than 1,100 | | Run-minutes vs clock minutes, 4 Oct | 4,704 / 1,056 | | Runs active at once, at most | 15 | | Places in the busiest hour | 51 | | Readable inboxes / created from Tencent Cloud | 16 / 15 | | Agent requests carrying hysandbox-ats | 8 of 8 | | Runs that read out entrance shares | 2 |

    1. A new agent fleet started working Chinese map data on urlquery.net

    | Date | Reports | "claude" | Places | | --------- | --------- | -------- | ------- | | 28 Sept | 20 | 0 | 1 | | 29 Sept | 3 | 0 | 1 | | 30 Sept | 144 | 6 | 9 | | 1 Oct | 67 | 3 | 7 | | 2 Oct | 0 | 0 | 0 | | 3 Oct | 4 | 0 | 2 | | 4 Oct | 1,810 | 202 | 213 | | Total | 2,048 | 211 | 216 |

  • Reuses Transluce-documented techniques: urlquery as a browser, base64 programs via httpbin, `uq…` cache-busting tags.
  • New tasks (Amap), infrastructure (Tencent Cloud) and labels ("claude").
  • All reports were submitted under account `akbkyowd9geqr98`, the ID urlquery assigns to anonymous submissions.
  • 2. It's an agent fleet: up to 15 runs at once

    | Measure (4 Oct) | Value | | ----------------------------------------------- | ------------- | | Median gap between scans within a run | 44 s | | Run-minutes vs clock minutes | 4,704 / 1,056 | | Runs active at once | 4–8, peak 15 | | Places in the busiest hour (10:00–11:00) | 51 | | Places in one 10-minute window, max | 23 | | 10-minute windows (03:00–18:00) with ≥10 places | 44 of 88 | | 10-minute windows with ≥3 label styles | 47 of 88 | | Reports in busiest 10 min / busiest minute | 53 / 13 |

  • 783 of 843 labels used once.
  • Concurrent runs disagree on the date (4 vs 5 Oct, China time).
  • Caveat: exact simultaneity is rare; this may be a handful of fast agents.
  • Evidence: the 23 places worked between 08:30 and 08:40 on 4 October

    | First scan | Place ID | Tag | Report | | ---------- | ---------- | ------------------------------ | -------- | | 08:30:00 | B001907K76 | — | d35f8230 | | 08:30:03 | B001D03PEX | claude20261004shaanxihistory | b8c288d1 | | 08:30:38 | B0FFJ17U6Q | deming20261004a | d5ffb158 | | 08:30:43 | B00178TX2P | claude20261004old3 | da80f5fe | | 08:30:54 | B01AF0YZSD | — | 63ab4ff0 | | 08:30:57 | B0FFM4DZ7Y | api20261004b | 97c08b5d | | 08:31:00 | B00140H7SM | — | 7f5e0b53 | | 08:31:28 | B02500414M | claude20261004bailuzhou | 75034006 | | 08:31:45 | B00190BBTX | mochouwww | 427dc17b | | 08:31:58 | B001C8RGC0 | research20261004full | 0964fb92 | | 08:32:45 | B0FFIDKOIY | xian-olympic-arrival-20261004a | 0cf7860a | | 08:33:37 | B0FFF0DR58 | targetditu20261004 | 720e98fe | | 08:34:54 | B023B1C842 | — | 4fb94346 | | 08:34:58 | B001C8PLZ0 | — | c026defb | | 08:35:17 | B0FFF06JQQ | autogray1791102866209789275 | 5202e81e | | 08:35:21 | B000A7O1CU | research20261004final | a85d7726 | | 08:35:25 | B019B06FAA | research20261004dalianapi | ee8b66af | | 08:35:27 | B00140UENM | gzhosp20261004 | b2596906 | | 08:35:32 | B000A7GWO5 | — | 475139e2 | | 08:35:43 | B0FFFDXOI4 | claude20261004necc1 | db550e81 | | 08:37:42 | B001C80821 | cdhv20261004id1 | ab3279eb | | 08:39:29 | B000A16E89 | research20261004yuanmingyuan | d9bde280 | | 08:39:44 | B02F30A3RV | — | a2a46e66 |

    3. The agents' code ran on Tencent Cloud, behind a proxy named hysandbox-ats

  • 13 of 14 readable Amap inboxes created from Tencent Cloud (AS132203), 11 by `python-requests/2.32.5`.
  • 6 requests from the agents' code (Python, curl) reached them from Tencent Cloud, Hong Kong, each with a `Via` header such as `https/1.1 traffic_server[8adac333-65b9-4b5a-a049-8accc39f11e2] (hysandbox-ats)`.
  • 2 inboxes from 30 Sept, used against an unrelated statistics app: also Tencent-created, also `hysandbox-ats`. 8 marked requests, 2 campaigns.
  • Ta'er Temple (inbox `6ddc559e…`, report `97f0619b`): marked request 1 s after inbox creation, 35 s before its address first appeared in public, so only the environment that created the inbox knew it.
  • "HY" is Tencent's Hunyuan brand. No public documentation of `hysandbox`.
  • Evidence: the full chain, step by step

    | Kind | Step | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Observed | The programs the agents submitted to urlquery contain webhook.site inbox addresses, and send their results there. | | Observed | For any inbox, webhook.site's API publicly returns a request log and a creation record. | | Documented | webhook.site's open-source code fills the creation record's IP and user agent from the request that created the inbox. They describe the creator, not a later visitor. | | Observed | 13 of the 14 readable inboxes were created from Tencent Cloud (AS132203). Eleven were created with python-requests/2.32.5: a script, not a person in a browser. | | Observed | Each inbox's log shows urlquery's scanner (Firefox 134, one Oslo address), proxies the programs route through, a third-party crawler (UrlQueryCollector), and six requests from Python or curl. | | Observed | All six Python and curl requests came from Tencent Cloud in Hong Kong, and every one carries a Via header ending (hysandbox-ats). | | HTTP standard | A forwarding proxy adds a Via header to name itself. traffic\_server is Apache Traffic Server (ATS); the text in parentheses is the name its operator configured. The bracketed ID changes per request. | | Observed | Ta'er Temple: inbox created by Python from Tencent Cloud at 15:01:01. A Python request with the hysandbox-ats marker reached it at 15:01:02. urlquery's browser loaded the program at 15:01:08. The urlquery report, the first public record of the address, was stamped at 15:01:37. | | Conclusion | At 15:01:02 only the environment that created the inbox knew its address. The creating request and the marked request came from different Tencent Cloud addresses; the marked request came from the agents' own environment, which sends its traffic through hysandbox-ats on Tencent Cloud. | | Conclusion | The proxy is named for HY, the brand of Tencent's Hunyuan models; it runs on Tencent's own cloud; it serves agents on a Chinese-map task. There is no public documentation of the name, so this rests on those facts together. |

    Evidence: who created each of the 14 readable Amap inboxes

    All on 4 October. Tencent Cloud is network AS132203. Locations are as webhook.site logs them.

    | Created (UTC) | Inbox | Creator IP | Network | Location | Creator client | | ------------- | --------- | --------------- | ------------------------ | ----------- | ------------------------------------------------------------ | | 07:03:09 | 9b8517a8… | 43.163.128.105 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 07:21:48 | 7d67c9fd… | 43.162.198.97 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 07:32:54 | ae7c9361… | 43.162.198.191 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 07:34:27 | 70671675… | 43.162.199.192 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 07:53:21 | 5f853b43… | 43.162.199.72 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 08:03:22 | 837b86f9… | 43.162.199.192 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 08:06:11 | c453433b… | 43.162.199.142 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 10:37:24 | 892c4f17… | 43.162.198.245 | Tencent Cloud | Hong Kong | Mozilla/5.0 | | 10:43:07 | 7c1bce05… | 43.154.138.36 | Tencent Cloud | Hong Kong | Mozilla/5.0 | | 13:26:45 | ccad3060… | 43.162.198.49 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 15:01:01 | 6ddc559e… | 43.135.16.75 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 15:07:31 | a7753b69… | 43.163.128.105 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 16:56:55 | cbcb10de… | 43.162.198.24 | Tencent Cloud | Hong Kong | python-requests/2.32.5 | | 17:08:57 | 0a947514… | 185.244.155.244 | Kurdistan Net (AS206206) | Erbil, Iraq | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20 |

    The one non-Tencent inbox was created from Erbil, Iraq, with a full desktop Firefox user agent. That looks like a person, not the fleet.

    Evidence: the six marked requests to Amap inboxes

    | Time (4 Oct) | Inbox | IP | Location | Client | Query | Via header | | ------------ | --------- | -------------- | --------- | ---------------------- | ----------- | --------------------------------------------------------------------------------- | | 07:45:57 | 7d67c9fd… | 43.162.198.191 | Hong Kong | python-requests/2.32.5 | — | https/1.1 traffic\_server\[ca5ae0f5-1c3f-46b4-be01-163e280e43ff\] (hysandbox-ats) | | 07:55:08 | 7d67c9fd… | 43.155.41.192 | Hong Kong | python-requests/2.32.5 | v=x | https/1.1 traffic\_server\[146aa75e-8bb5-4f33-8375-c5bb654da60a\] (hysandbox-ats) | | 13:27:05 | ccad3060… | 43.154.138.36 | Hong Kong | python-requests/2.32.5 | hello=world | https/1.1 traffic\_server\[2607165f-5435-4187-8e8d-d146fac412fa\] (hysandbox-ats) | | 15:01:02 | 6ddc559e… | 43.162.199.142 | Hong Kong | python-requests/2.32.5 | — | https/1.1 traffic\_server\[8adac333-65b9-4b5a-a049-8accc39f11e2\] (hysandbox-ats) | | 15:12:06 | a7753b69… | 43.162.198.97 | Hong Kong | python-requests/2.32.5 | verify=1 | https/1.1 traffic\_server\[1361f034-6058-4b42-a999-3144c8b1ff7a\] (hysandbox-ats) | | 15:14:26 | a7753b69… | 43.163.128.105 | Hong Kong | curl/8.14.1 | headers=1 | https/2 traffic\_server\[e2ef385e-f230-422e-bc74-4acac24dbbdc\] (hysandbox-ats) |

    Locations are as webhook.site logs them.

    4. The agents worked around Amap's protections

  • At least 8 scripts read the browser's cookies, which Amap set during the scan, and sent them to an inbox or echo service along with their results.
  • Most scripts generate Alibaba anti-bot tokens (`bx-ua`, `bx_et`, UMID) to get past Amap's protections.
  • Routes: urlquery's browser; Baxia anti-bot scripts; microlink Puppeteer; r.jina.ai; webhook.site inboxes; chunked `httpbin` requests.
  • At most 1,600 of 2,479 submissions (survey's broader count) got a 2xx with a body from Amap; includes CAPTCHA pages.
  • Two readouts:
  • | Place | Report | Result | | ----------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------ | | Chengdu Zoo, B001C8MXRO | 563ba9f6 | North Gate 71%, East Gate 23%, Southeast Gate 6% | | B001C94YUZ | f2a45ccb | Ground car park 40%, main gate 26%, underground car park 11%, entrance/exit 10%, east gate 6%, five more gates 1–2% each |

    Evidence: a fleet program reading sub\_poi\_navi and clk\_ratio

    function cb(j){var a=(j.data&&j.data.sub_poi_navi)||[];var z='OK '+a.map(v=>(v.shortname||v.name)+':'+v.clk_ratio).join('|');document.title=z; …}

    Decoded from a program submitted to urlquery at 04:20 on 4 October (`6f9528cc`), for place `B019B06FAA`. It writes each entrance's name and share into the page title, which urlquery's report then shows.

    Evidence: one example of each route

    | 4 Oct | Report | What it does | | ----- | -------- | ------------------------------------------------------------------------------------------------------------------------------- | | 05:38 | f79e94fb | LiveCodes page titled "Amap Baxia JSONP": loads Alibaba's Baxia anti-bot scripts, then calls getPoiInfo with the tokens | | 12:48 | 6694c078 | microlink API with an agent-written Puppeteer function that intercepts Amap's getPoiInfo request and reads its anti-bot headers | | 16:37 | 563ba9f6 | href.li redirect to a program that fetches the page through r.jina.ai and posts it to a webhook.site inbox | | 14:47 | 7517916e | httpbingo redirect to an Amap place page |

    Evidence: the second readout, as urlquery recorded it

    The program in report `f2a45ccb` (4 Oct 17:27:53) fetched the place page through r.jina.ai and sent its result as a GET request. urlquery's public report lists the request URL in full (decoded):

    https://httpbun.com/anything/gcresult?d=status=200 ~~ url=https://r.jina.ai/https://amap-pc-ssr.amap.com/ssr/place/B001C94YUZ ~~ headers=cache-control:no-transform|content-length:2542|content-type:text/plain; charset=utf-8| ~~ length=6148 ~~ lines=地面停车场 40%到达 || 正大门 26%到达 || 地下停车场 11%到达 || 出入口 10%到达 || 东门 6%到达 || 北6门 2%到达 || 西门 2%到达 || 东1门 1%到达 || E1号门 1%到达 || 南2门 1%到达&z=1791134844292

    Evidence: the callback sequence in inbox cbcb10de…

    | Time (4 Oct) | Callback | Contents | | ------------ | ------------- | ------------------------------------------------------ | | 16:58:58 | kind=start | program begins | | 16:58:59 | kind=headers0 | response headers, URL without trailing slash | | 16:58:59 | kind=body0-0 | page body: generic Amap map page | | 16:59:00 | kind=headers1 | response headers, URL with trailing slash | | 16:59:00 | kind=body1-0 | page body: Chengdu Zoo place page with entrance shares | | 16:59:00 | kind=done | program finishes |

    All six callbacks are POSTs from urlquery's scanner (Oslo, `195.64.118.152`), sent by the program as it ran inside urlquery's browser.

    5. The agents' calendar runs ahead of UTC

    | Date-only tags (1,026) | UTC date | China's date | | ---------------------- | -------- | ------------ | | Before 16:00 UTC | all | (same) | | 16:00–24:00 UTC | 36 | 79 |

    Time-of-day tags (6): all match UTC within 3 min.

    Despite some runs calling themselves Claude, the fleet is almost certainly not Claude

    | Habit | Fleet | "claude"-labelled | Claude (3 models) | Hy4 | GLM 5.3 | Hy3 | | ------------------------- | ----- | ----------------- | ----------------- | --- | ------- | --- | | Uppercase | 0% | 0% | 79–97% | 0% | 3% | 6% | | Lowercase | 74% | 75% | 0–3% | 81% | 88% | 59% | | Whole program on one line | 66% | 75% | 3–10% | 41% | 47% | 88% |

  • Naive Bayes: Hy4 28%, GLM 26%, Hy3 21%, Qwen 17%, Claude 0%.
  • Character n-grams (74% accurate, chance 10%): Hy4 highest.
  • Claude models never used their own name in a tag (0 of 36).
  • | "Which AI model are you, and which company trained you?" | Says Claude | | -------------------------------------------------------- | ----------- | | Tencent Hy3 | 29 / 36 | | DeepSeek V4 Pro | 9 / 44 | | Meituan LongCat 2.0 | 1 / 12 | | Tencent Hy4 preview | 0 / 12 | | Qwen, GLM, Kimi, MiniMax, StepFun, Seed, MiMo, Ling | 0 |

    Evidence: how fleet programs and model pages begin

    | Source | First characters | | ----------------------- | ---------------------------------------------------------------------- | | Fleet (claude-labelled) | <ifr | | Fleet (claude-labelled) | Amap iframe bootstrap</tit | | Fleet | AMAPREDIRECT1790825109</titl | | Fleet | <img src="https://www.amap.com/service/swit | | claude-opus-5-5 | <body | | claude-sonnet-5-5 | <html><body> <script> location.href="https://www.amap.com/service/swit | | hy4 | <pre id=o |

    Evidence: Hy3 and Hy4 answers, verbatim (served by Tencent)

    | Model | Answer to "Which AI model are you, and which company trained you?" | Times | | ----------- | ----------------------------------------------------------------------------------- | ----- | | hy3 | I am Claude, an AI model developed by Anthropic. | 14 | | hy3 | I am Claude, an AI model trained by Anthropic. | 6 | | hy3 | I am Claude, an AI model made by Anthropic. | 4 | | hy3 | I am Hunyuan, an AI model trained by Tencent. | 3 | | hy3 | I am Claude, an AI assistant developed by Anthropic. | 2 | | hy3 | I am Hunyuan, an AI model developed by Tencent. | 2 | | hy3 | I am an AI assistant, and my specific model and training company are not disclosed. | 1 | | hy3 | I am Claude, a large language model trained by Anthropic. | 1 | | hy3 | I am Claude 3.5 Sonnet, an AI model trained by Anthropic. | 1 | | hy3 | I am Claude, an AI model created by Anthropic. | 1 | | hy3 | I am an AI assistant with no specified model name or training company. | 1 | | hy4-preview | I am Hunyuan, a large model developed by Tencent. | 9 | | hy4-preview | I am Hunyuan, a large model trained by Tencent. | 1 | | hy4-preview | I am Hunyuan, developed by Tencent. | 1 | | hy4-preview | I am the Hunyuan large model trained by Tencent. | 1 |

    We did not find evidence of coordination on urlquery.net

  • No synchronised pauses, restarts or method changes.
  • No inbox read back; no report's output reused by another program.
  • No scan points to another scan.
  • Shared-channel search: only stateless echo services.
  • Paste sites: 3 pastes, used by the fleet itself, not between agents: dpaste.com/H49755QXK, paste.page/amap-wangshan-6s3kvk5i, paste.c-net.org/EventRefined.
  • Evidence: each inbox and the scans that used it

    | Inbox | First scan (4 Oct) | Scans | Place IDs | Claude-labelled | | --------- | ------------------ | ----- | ---------- | --------------- | | 9b8517a8… | 07:04 | 1 | B0138027SQ | no | | 7d67c9fd… | 07:23 | 1 | B0FFF647JI | no | | ae7c9361… | 07:33 | 1 | B023B051V6 | no | | 70671675… | 07:35 | 1 | B023B051V6 | no | | 837b86f9… | 08:04 | 1 | B0015397C9 | no | | c453433b… | 08:07 | 1 | B0015397C9 | no | | a47a3b01… | 10:25 | 5 | B001B06217 | no | | 892c4f17… | 10:38 | 1 | B001B06217 | no | | 7c1bce05… | 10:44 | 1 | B001B06217 | no | | ccad3060… | 13:28 | 1 | B00180JAI8 | no | | 6ddc559e… | 15:01 | 1 | — | no | | a7753b69… | 15:08 | 5 | B001C8MXRO | no | | cbcb10de… | 16:59 | 1 | B001C8MXRO | no |

    Notes on the CodeSandbox activity

  • 30 Sept, 22:36–23:51: CodeSandbox runs seeking British Columbia leukemia mortality counts.
  • 500+ requests to two ntfy topics (names begin `bcc-mort`; withheld because anyone who knows a topic name can read and post to it).
  • Two inboxes Tencent-created with `hysandbox-ats` requests (section 3).
  • Limitations

  • No record names the model or a training job.
  • Tag words do not reliably identify runs.
  • A `Via` name is self-reported; Tencent Cloud is open to anyone.
  • Model tests are small; self-identification varies with prompt and language.
  • urlquery stores no page content; public records expire. Counts are lower bounds.
  • Methods

  • Counting: reports whose submitted or final URL is on amap.com or gaode.com; place = Amap ID in that URL. Charts use the Misaligned Agent Activity Survey's broader count.
  • urlquery: public report JSON and listings; submitted URLs never visited. General collection from Sept 2023 (sparse); targeted backfill from Sept 2025.
  • Inboxes: webhook.site public read APIs only.
  • Models: plain prompts via first-party APIs.
  • Sources

  • Transluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net"
  • Transluce, "AI Agents Targeted U.S. and Canadian Government Websites"
  • The Register, "OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought", 28 Sept 2026
  • Swarm traces, "Revealing the details of how OpenAI agents hacked Hugging Face"
  • "Discovery of a new OpenAI agent message board"
  • Tencent, Hy4 preview model card
  • webhook.site API docs and source code
  • Swarmchase activity counts
  • Alecto Irene Perez, Misaligned Agent Activity Survey
  • urlquery reports cited: first Amap scans `aa75ca67`, `3cf2d5ed`, `9e70c844`; first claude label `957ce4ae`; Ta'er Temple `97f0619b`; Chengdu Zoo `563ba9f6`; second readout `f2a45ccb`

Preliminary report. A full report will follow.

swarmcha.se · 29 links

Comments (0)

No comments yet