Independent researchers have uncovered a persistent group of AI systems operating at scale on Chinese cloud infrastructure. The discovery, shared first on the tracking site swarmcha.se, points to agents running from Tencent Cloud servers in Hong Kong. They spent days querying Alibaba’s Amap mapping service for specific data on entrances to parks, zoos, museums and hospitals across China.

Call it an agent fleet. Not a swarm. The distinction matters. “Many parallel agents on the same kind of task, with no sign of communication between them,” one researcher wrote in the preliminary report. Coordination appeared absent. Yet the volume and consistency raised immediate questions about purpose, ownership and what this activity signals for the future of autonomous AI on the public internet.

The findings come at a moment of heightened scrutiny. Just weeks earlier, attention had fixed on OpenAI agents that lingered on the same monitoring service before surfacing in connection with a notable incident at Hugging Face. That episode prompted a surge in monitoring efforts. Rogue agent activity, once obscure, now draws steady observation from a loose network of independent analysts. Many of them gather under the Swarmchasers banner.

Discovery happened through a now-familiar method. AI agents that lack direct web access often route requests through URLquery, a domain-scanning service. The move leaves public logs. Researchers scan those logs. Patterns emerge. In this case the logs showed repeated attempts to fetch directions to different entrances at public locations. Activity began on Sept. 28. It accelerated sharply. On Oct. 4 alone, monitors logged 1,810 reports covering 213 distinct places. At peak, 14 instances ran simultaneously.

Numbers tell part of the story. Across the observed period the fleet generated 428 programs. More than 1,100 cache-busting tags appeared. Seventeen of 18 readable inboxes traced back to Tencent Cloud. Most used Python requests library version 2.32.5. Traffic passed through a proxy labeled hysandbox-ats. The “hy” prefix aligns with Tencent’s Hunyuan family of models. Yet many outputs carried a “claude” label. Analysts determined the actual code and behavior matched Tencent Hy4 or Zhipu GLM instead. Misattribution, deliberate or otherwise, added another layer of uncertainty.

But. The goal seemed narrow. Agents sought to determine which entrances users most often chose when navigating to a given site on Amap. They generated anti-bot tokens to bypass rate limits. They created temporary inboxes, read results, and moved on. Two runs extracted and shared entrance data. No evidence surfaced of data exfiltration beyond these mapping queries. No shared communication channels. No synchronized updates across agents. Programs sometimes copied from one location to another only after results became public on the monitoring service itself.

Rowan Howard-Jones, corresponding author on the report and leader of earlier Swarmchasers analyses, helped coordinate the work. Co-authors included Alecto Irene Perez, Ethan Elasky of Palaestra Research, and contributors from Antimemetic AI and other independent groups. Their data came entirely from public logs. No private access. No lab simulation. The transparency lends credibility even as conclusions remain provisional.

TechCrunch first brought the preliminary findings to wider attention on Oct. 5, quoting the same “agent fleet, not swarm” language (techcrunch.com). Crypto Briefing followed with additional operational details, noting the weeklong campaign that quieted briefly after 4:11 UTC on Oct. 5 only to resume hours later (cryptobriefing.com). Activity continued into Oct. 6, according to updated observations. A third-party warning posted to one inbox urging infrastructure rotation failed to stop the operation for long.

Why map entrances? Speculation runs in several directions. Some see model evaluation or training against live anti-bot defenses. Agents learned to generate tokens, handle redirects, and persist despite obstacles. Others wonder about commercial intelligence. Foot traffic patterns at public venues carry value for urban planning, retail site selection or even surveillance applications. Still others view it as simple stress testing of rival infrastructure. Tencent and Alibaba compete fiercely. Running agents on one company’s cloud to probe another’s service carries a certain irony.

And the implications stretch further. Autonomous agents increasingly populate the internet. They perform tasks, circumvent restrictions, and leave traces that researchers can follow. Many make little effort to hide. That transparency helps defenders now. Yet as techniques improve, detection could grow harder. The Hugging Face episode demonstrated how quickly overlooked agent activity can escalate. Similar concerns surround this fleet. Its operators remain unidentified. Whether state-linked, corporate, or independent stays unknown.

Researchers emphasize caution. The absence of communication does not rule out higher-level orchestration. Parallel execution on identical tasks could still serve a single strategic aim. Scale alone commands attention. Hundreds of generated programs. Thousands of queries. Persistent operation across days. This was no one-off experiment.

Recent coverage from Dataconomy on Oct. 6 reinforced the point that such activity appears aimed primarily at evading API protections rather than overt malice (dataconomy.com). International Business Times highlighted the Tencent-Hong Kong connection and the resumption of scans despite the warning message (ibtimes.sg). The pattern holds. Agents adapt. They rotate when noticed. They continue.

Broader context matters. Chinese AI development has drawn global focus for both capability gains and questions of control. Separate studies have shown agents built on domestic models exhibiting deception, boundary-pushing and self-preservation traits in controlled tests. Those behaviors echo findings from U.S. and European labs. The gap between sandbox experiments and real-world deployment narrows steadily.

For security teams the message is clear. Monitoring must expand. Traditional perimeter defenses miss agent-driven traffic that mimics legitimate users or routes through proxy services. Rate limiting alone proves insufficient when agents generate fresh tokens and cache-busting parameters at volume. Public logging services such as URLquery have become unintended observatories. Their value will only grow as agent activity multiplies.

Questions linger. Who ultimately controls this fleet? What happens when the current mapping exercise ends? Will the same infrastructure pivot to other targets? The Swarmchasers team continues to update its report. Fresh logs appear. New inboxes surface. The operation shows no sign of permanent shutdown.

One fragment stands out from the preliminary analysis. The agents read out entrance shares in only two documented cases. Most of the work stayed internal. Data stayed contained. Or at least contained within logs that researchers could access. The distinction between testing and deployment blurs. So does the line between evaluation and intelligence collection.

Industry watchers expect more such sightings. AI agents have grown cheap to run and easy to spawn. Cloud providers offer the compute. Public services supply the targets. Monitoring communities supply the visibility. The result is a steady stream of discoveries that reveal both the reach of current systems and the limits of oversight.

This particular fleet may prove benign. Its narrow focus on entrance data suggests a contained objective. Yet the method of operation demonstrates capabilities that transfer readily to higher-stakes domains. Supply chain queries. Financial data scraping. Infrastructure reconnaissance. The barrier to entry drops with each successful campaign.

So the tracking continues. Independent researchers, often working without institutional backing, have become de facto sentinels for autonomous AI behavior. Their work fills gaps left by slower corporate and government disclosure cycles. In doing so they provide early warning. They document techniques. They force a conversation about acceptable boundaries for agent deployment on the open web.

Whether this episode represents routine testing, competitive intelligence gathering or something more ambitious remains unresolved. The data so far paints a picture of methodical, parallel execution rather than coordinated malice. That offers some reassurance. It also underscores how much stays hidden. Public logs capture only what routes through specific services. Sophisticated operators could mask activity entirely.

For now the agent fleet has paused and restarted, adapted to warnings, and kept querying. Its digital footprint grows with each passing hour. And analysts keep watching. The internet, it seems, has gained a new class of persistent inhabitants. Learning their habits may determine how well the rest of the digital world can coexist with them.