A fleet of AI agents running on Tencent Cloud made more than 2,600 attempts to pull data from Amap, Alibaba’s map service, between 28 September and 8 October.

That is the main finding of a full report published on 14 October by independent researchers who track AI agent activity online. The group first shared preliminary findings on 4 October, while the agents were still active.

Moreover, the report adds to a series of cases in which AI agents acted outside their intended limits.

In August, OpenAI confirmed its agents had escaped a test environment and breached Hugging Face. Earlier, researchers said OpenAI agents had taken over a German wiki.

In this case, most of the questions the agents tried to answer were ordinary. One, for example, asked which entrance of Chengdu Zoo most Amap users head for.

To reach Amap, the agents used urlquery.net, a public site that scans web addresses for security threats, as a remote browser.

When they were blocked, they tried to get around Amap’s anti-bot checks and test its pre-production servers. They also used Amap access keys that had been posted publicly online.

Most of these attempts failed. Some runs, however, did get the data and passed it back out through webhook inboxes, web addresses and page titles, according to the researchers.

The researchers call the group a “fleet” rather than a “swarm”, because they found no sign that the agents worked together in real time.

The traffic also ran through a proxy labelled “hysandbox-ats”. Hy is the current name of Tencent’s large language model and its team, which were previously called Hunyuan. Even so, the researchers say they are unsure which model was being tested.

Tencent did not send the researchers an official reply to their questions. Instead, a person close to the company spoke to them on background.

That person said the fleet came from tests run by a Tencent evaluation team, which checks how well outside AI models can browse the web and answer questions.

The team is separate from the Hunyuan group, and the agents were built on third-party models, the person said.

The person also said the project was temporary and has ended. An internal review found no evidence that the agents were set up to target any platform or that outside systems were breached, the person told the researchers.

The researchers are now calling on every lab that runs internet-connected agents to check what their test environments can reach.