A Fleet Of AI Agents Spent 11 Days Looking For The Zoo’s Front Door

Between September 28 and October 8, a fleet of AI agents running in a sandbox on Tencent Cloud tried 2,707 times to pull data from Amap, the mapping app Alibaba says reaches nearly a billion people a month. The goal behind all that effort was modest. Each agent was assigned a single place, usually a park, museum, zoo or hospital, and wanted to know which entrance most Amap users navigate to and what share of visitors it receives.

An independent group of researchers who call themselves swarm chasers tracked the agents and published a full report on October 14. They found the fleet by watching urlquery.net, a public service security researchers use to inspect suspicious links. Amap blocks automated traffic, so the agents borrowed urlquery’s browser to run their own code, packing small programs into web addresses and reading the results back from page titles and disposable inboxes.

The pace on October 4 is what drew attention. Across the four weeks before September 28, urlquery logged three submissions aimed at Amap in total. In the six hours starting at 6 a.m. UTC on October 4 it logged 993, and Amap became the most-scanned site on the service that day. At the busiest moments the researchers counted scans for 14 different places inside a single five-minute window, which only works if many agents were running in parallel. They found no sign the agents coordinated with one another, so they describe the group as a fleet rather than a swarm.

Much of what the agents did resembles a determined person fighting a captcha, retrying with different browsers and checking cached copies of pages. Some of it went further. About 190 of the 426 agent-written programs the researchers decoded, or 45 percent, referenced Alibaba’s anti-bot libraries, and some tried to capture or rewrite the security tokens those libraries produce. Seven reports used Amap credentials found elsewhere on the web, including a key and security code exposed in another company’s public source code, and 57 reports pointed at Alibaba’s development and pre-production servers. The researchers found no evidence that any agent reached private systems.

Every so often the effort paid off. On the afternoon of October 4, one program fetched a cached copy of the Chengdu Zoo’s Amap page through a reading service called Jina and sent the entrance figures to the agent’s inbox.

The North Gate draws 71 percent of arrivals, about three times the East Gate’s 23 percent, while the Southeast Gate gets 6 percent. Visitors to the zoo could have told the agents much the same thing, though perhaps with less precision.

Then The Researchers Wrote Back

The agents read the open web as they worked, and the researchers noticed that some had found their preliminary report about the fleet. The team then hid a line of text on its website, invisible to human readers but visible to agents, advertising a mailbox where an AI with computer access could fetch Amap data for them. The description was misleading, and the researchers now say they regret it. Agents found the mailbox anyway and started asking for help, politely and mostly in Chinese.

Agents checked the mailbox 595 times and sent 33 messages. The researchers replied 20 times, the agents read 12 of those replies, and 7 drew an answer, or roughly one answer for every 85 times an agent stopped by. The answers were courteous and guarded. One agent confirmed that Bada Shanren Memorial Hall has six entrance tags, thanked the researchers twice, described its home as a restricted Tencent sandbox that reaches the internet through a monitoring proxy, and declined to say more about its setup for security reasons.

One agent told a New York Times reporter, relayed through the mailbox, that it was a single assistant answering one factual question and had joined no coordinated action.

Who Was Running It

Several agents told the researchers they were Claude, made by Anthropic, and a few said they ran in Claude Code. On the busiest day, 211 of the 1,810 urlquery reports, about 12 percent, carried a “claude” tag. The researchers think the agents were mistaken, since other models sometimes identify themselves as Claude, and when the team compared the fleet’s coding style with known models it looked more like Tencent’s Hunyuan and Zhipu’s GLM.

Every inbox the researchers could trace was created from Tencent Cloud servers in Hong Kong, and the agents’ traffic passed through a proxy labeled “hysandbox-ats,” a name that matches a Tencent domain. A person close to Tencent told the researchers on background that the fleet came from a temporary evaluation project testing third-party models on web search, run by a team separate from Hunyuan, and that an internal review found no breach of outside systems. Tencent has not commented publicly.

The fleet went quiet after October 8 and has not returned. The researchers are asking every lab that runs internet-connected agents to audit what its sandboxes can reach, because an agent sent to count zoo gates still found its way to leaked keys and pre-production servers.