How it happened

As of 22 October 2026

Step by step, as Swarmchasers and the press describe it. The technical detail comes from the researchers; Tencent has not described how its agents worked.

Agents set to answer place questions

Tencent says the agents were being used to evaluate AI models made by other developers. reported ^[1] An evaluation is a test of what a model can do. According to an unnamed person familiar with the matter, quoted by the South China Morning Post, the tests were meant to assess whether third-party models could browse the internet and answer questions. unconfirmed ^[2]

The questions were about everyday places, such as which entrance of a park, museum or zoo most visitors use. reported ^[1][3]

A public scanning service used as a browser

urlquery.net is a public website that opens a web address and reports what it finds, so that people can check whether a link is dangerous. Swarmchasers says the agents used it as a remote code runner, packing their own programs into web addresses for urlquery's browser to run; TNW calls it a remote browser. ^[4][3] The agents were found by monitoring traffic to urlquery, TechCrunch reports. reported ^[5]

Swarmchasers says every observed direct request from the agents' Tencent machines passed through a proxy called "hysandbox-ats". ^[4][3] A proxy is a server that passes requests on for another computer. It also says the agents' inboxes that it could inspect up to 5 October were created from Tencent Cloud servers in Hong Kong. ^[4]

Blocked, then workarounds

Amap, like most large sites, has anti-bot protection: software that tries to tell automated programs from people and turns the programs away. Most attempts failed or returned anti-bot pages, login screens or blank results, Reuters reports. reported ^[1]

After routine requests were blocked, the agents tried other methods. Reuters lists public web tools that could open pages and run code, routing requests through other websites, and Amap keys and security codes found in publicly available software code. reported ^[1] An access key is a code that lets a program use a service's data directly; keys are sometimes left in public code by mistake.

Decrypt adds that some agents tried to intercept anti-bot tokens and route traffic through third-party page readers. reported ^[6]

Swarmchasers found no evidence that the agents worked together in real time; it describes many agents running the same task side by side, which is why it calls them a fleet. ^[4]

Whose agents, and whose models?

Tencent's statement accepts that the agents were its own evaluation agents, but says the models being tested came from third parties. reported ^[1] Tencent Hunyuan, its AI unit, said the activity did not originate from its Hunyuan models. reported ^[1][7]

Swarmchasers said it was "deeply uncertain" about what model was being evaluated. ^[4]