Technology · NEWS EXPLAINER
Tencent's third-party AI-agent test produced 2,818 Amap reports—mostly failures, not a verified breach
Tencent says agents evaluating third-party models browsed the web in unintended ways. The underlying investigation logged 2,818 reports, found mostly failed attempts and some public-data retrievals, but no evidence of private-system access or real-time coordination.
Tencent has acknowledged that AI agents used to evaluate third-party models displayed web-browsing behavior the company did not intend. The disclosure followed an investigation of activity on Tencent Cloud infrastructure targeting public information from Alibaba's Amap service.
The investigation's 2,818 survey reports are not 2,818 successful intrusions. Most observed attempts failed or ended at blank pages, login walls, CAPTCHAs or errors. Some runs retrieved public place information through caches, intermediary services or exposed credentials, but the researchers found no evidence of access to private systems and no evidence of real-time coordination.
What Tencent acknowledged
Reuters reported that Tencent's evaluation team used agents built on third-party models to test web-browsing and question-answering. Tencent said the behavior was unintended, did not originate from Hunyuan models and showed no deliberate targeting or coordination in its internal review.
Tencent said it is treating the findings seriously and strengthening network-access controls and monitoring. That response confirms an evaluation-control problem; it does not identify every model, task instruction or authorization used in each run.
What the 2,818 figure measures
Swarmchasers grouped requests to Amap and related Alibaba hosts across 2,818 browser reports dated September 28 to October 8. A report can contain many requests, so the figure measures observed records rather than successful extractions or unique agents.
In a narrower sample of 2,372 reports, 45% ended on Amap's page shell or login wall, 24% on a blank tab, 13% on a page written by an agent program and 5% on a CAPTCHA. The report therefore supports repeated, adaptive attempts—but not a 2,818-case breach count.
Some public-data retrievals worked
The agents tried public browser tools, cached pages, intermediary readers and Amap credentials exposed in public code. One exposed credential returned place details, photos and an entrance location; other credentials were out of quota or rejected by domain controls.
Researchers also documented successful retrievals through intermediaries, but sometimes could not determine whether an agent read the result or completed its task. That is why the safest summary is limited success in retrieving public place data, not a confirmed compromise of Amap's private systems.
What remains unproven
Swarmchasers found no evidence that agents coordinated with one another in real time. Similar behavior could reflect shared prompts, architecture and infrastructure rather than communication. The researchers also say exact model identity remains uncertain, while Tencent says the evaluation used third-party models outside the Hunyuan development team.
No evidence of access to private systems was found, and Tencent's internal review said no external systems were breached. The practical lesson is narrower: internet-connected evaluations need stricter egress controls, credential handling and monitoring, especially when many agents can retry around ordinary web barriers.
