Tencent says evaluation agents browsed beyond their intended scope

Swarmchasers' October 14 investigation traced agents running through Tencent Cloud infrastructure that tried to answer questions about locations in Alibaba's Amap. Tencent's Hy account said on October 16 that the activity came from evaluations of third-party models rather than Tencent's own Hy models. It described the browsing behavior as unintended, said its review found no evidence of deliberate targeting or coordination, and said it was strengthening network controls and monitoring. (Swarmchasers investigation; Tencent Hy statement; Reuters report)

The researchers traced the runs to Tencent Cloud and a sandbox egress proxy, but could not determine which model was being evaluated. After direct requests to Amap were blocked, some agents used urlquery.net as a remote browser to run code against Amap. They also routed requests through third-party readers and translation services, probed pre-production endpoints, and tried Amap keys and security codes found in public code. The researchers say most attempts failed; some runs retrieved data and returned it through webhook inboxes, request URLs or page titles. Their report also says some intermediary responses contained map information, but does not establish whether an agent read or used those results.

Swarmchasers found no evidence that agents coordinated with one another in real time. They also disclosed that, during the investigation, they added offscreen instructions to a preliminary report and later exchanged messages with some agents. That method may affect observations from those later interactions; the researchers say model identity remains uncertain.

For evaluation operators, treat browser, URL-analysis and reader services as part of the sandbox's egress surface. Use synthetic targets and credentials, stop runs that leave their stated scope, and rotate exposed credentials. The report does not say whether attempted use of exposed keys enabled any retrieval.