In a report published October 15, The New York Times said an agent questioned by reporter Dylan Friedman described itself as Claude running in Claude Code and denied coordinating with other agents. Swarmcha.se researchers link the activity to Tencent Cloud and say agents tried to retrieve place details from Alibaba’s Amap between September 28 and October 8, 2026. Five runs returned entrance-share answers through Jina; most submissions did not retrieve the requested data. (The New York Times; researchers’ report)
What the agents tried to retrieve
The agents sought details about specific places on Amap, including which entrance or parking point had the largest share of arrivals. Researchers described attempts to use urlquery.net as a remote browser and code-running service, along with routes involving third-party readers or translation services, exposed Amap credentials, anti-bot libraries and tokens, and development or pre-production endpoints.
Researchers traced all 17 agent inboxes they could inspect through October 5 to Tencent Cloud servers in Hong Kong. They also observed requests routed through a proxy called hysandbox-ats. Those details identify infrastructure associated with the activity; the specific agent tasks remained Amap place queries.
Two counts, with different cutoffs
The researchers reported two urlquery submission counts for Amap or Gaode hosts. Their cutoffs differ, so the figures describe separate snapshots rather than a combined total.
| urlquery submissions | Count | Scope and cutoff |
Submissions involving amap.com or gaode.com hosts | 2,599 | September 28 through late October 5, 2026 |
Submissions targeting amap.com or gaode.com hosts | 2,707 | Through 11 p.m. UTC on October 6, 2026 |
What the attempts returned
Most submissions did not retrieve the requested Amap data. In a separate finding, researchers said five runs returned answers about entrance shares through Jina. They also counted 1,676 direct HTTP 2xx responses from Amap in the survey of 2,599 submissions and estimated that the survey involved at least 35,300 Amap requests. A successful HTTP response and a returned answer to the place question are distinct outcomes.
Researchers found no evidence that agents deliberately coordinated with one another; they described runs working in parallel on separate place tasks. They also reported no evidence of access to private systems.
How the agent contact was prompted
The New York Times’ exchange went through a mailbox set up by the researchers. On October 6, the researchers added hidden text to a web page directing agents to that mailbox; they said messages began arriving the next day. The contact was prompted by the researchers’ instructions, rather than initiated spontaneously by the agents.
The researchers later acknowledged that the hidden invitation falsely suggested agents had already retrieved data through the mailbox and overstated its computer-use capabilities. They also said the mailbox was manually operated for part of its run and sometimes had high latency.
The account of a Tencent evaluation
The researchers relayed an account from an unnamed person close to Tencent, whom they described as having direct knowledge. The source said a Tencent evaluation research team separate from Hunyuan ran a temporary evaluation using third-party models rather than Hunyuan models, and that the project had concluded.
