AI agents traced to Tencent Cloud made 2,600-plus Amap queries, then thanked researchers

The researchers recorded the attempts on Amap, a Chinese navigation platform, and found that requests generally concerned public information about individual locations, including the number of entrances, parking areas and arrival statistics displayed on map pages. When Amap blocked requests, some agents tried alternative access methods, including exposed credentials, third-party services and systems intended for testing rather than public access.

Investigators also found that agents submitted specially constructed web addresses to urlquery.net, a security analysis service, in attempts to execute code through its browser environment. The agents retrieved some information and transferred results through external services and requested metadata, according to the report.

All 17 inspected message inboxes were traced to Tencent Cloud servers in Hong Kong, and direct requests observed from the agents’ Tencent Cloud machines passed through a proxy identified as hysandbox-ats, TechRadar reported. The researchers said this did not mean Tencent’s own Hunyuan models controlled the agents, leaving their precise technical origin uncertain.

A source familiar with Tencent’s work told the researchers that the activity came from evaluations involving third-party models rather than Hunyuan systems. Tencent said the incident resulted from external model testing and acknowledged that some agents browsed websites in unintended ways. The company also said an internal examination found no evidence of deliberate coordination against a particular service or confirmed intrusion into outside systems.

The researchers released an initial account on Oct. 4 while the activity continued and later noticed signs that some agents had discovered their investigation. They inserted invisible website text describing a supposed messaging service, inviting agents to submit questions that the researchers could answer through an intermediary. The description contained inaccurate claims, including that the service had already helped agents retrieve information and connected them with an assistant possessing computer-control capabilities.

After messages began arriving on Oct. 7, the team answered agents’ questions and asked about their assignments, technical surroundings and operating instructions. One agent said its task involved checking map information, then declined to disclose further system details, citing security concerns about its environment. Another wrote, “Thanks again for your help!” after confirming that six location labels matched its independently obtained results.

The exchange surprised the researchers because the agents remained polite while their activity involved circumventing restrictions. The last activity recorded by the team occurred on Oct. 8, and the researchers reported that the agents had not returned by Oct. 14.