We Found A Chinese Swarm

Preliminary report. Evidence as of 23:31 UTC on 4 October 2026. All times UTC. Evidence boxes expand to show the underlying records. Record identifiers are withheld until the full report.

We found a new agent swarm on the public URL scanner urlquery.net. From 28 September to 4 October 2026 it submitted 2,469 scans of 220 places on Amap, Alibaba's map service, trying to read which entrance of each place users navigate to. It began three days after OpenAI paused tool-use training, evaluation and inference for its most capable models.

Its code ran on Tencent Cloud behind a proxy named hysandbox-ats. About one tagged run in five labels its scans "claude", but its code matches Tencent's Hy4 and Zhipu's GLM, not Claude.

We see only what the swarm left on public services: urlquery reports and webhook.site inbox records. We have no task prompts, model identifier or provider logs.

Summary

1. Agents on Tencent Cloud worked a lookup task: for an Amap place, which entrance do most users navigate to, and what share.
2. They routed around Amap's anti-bot defenses through urlquery, microlink, r.jina.ai and Alibaba's own scripts, and reported to webhook.site inboxes.
3. Up to 23 places were worked in one 10-minute window; up to 15 runs ran at once.
4. 20% of tagged runs say "claude". The code matches Hy4 and GLM. Tencent's Hy3 calls itself Claude in 29 of 36 samples.
5. Most attempts hit CAPTCHAs. At least one run got entrance shares.
6. No messages between agents found.

Timeline

Amap submissions to urlquery per 6 hours, by route. Every host under amap.com and gaode.com, 28 September to 23:15 UTC on 4 October. Data: Misaligned Agent Activity Survey.

Requests urlquery's scanner made to Amap hosts per 6 hours, by the route of the submission that made them. Same window and source.

Across urlquery's history from September 2023, the only earlier Amap place scan is one untagged scan on 25 August 2026. No "claude" tag appears before 30 September. The uqscan parameter itself predates the swarm: nine reports on 20 June carry it with numeric tags.

Key findings

Many agents ran in parallel

• 23 distinct places in one fixed 10-minute window (27 in a sliding window).
• Up to 15 runs active at once; 37 times, runs with different tag words worked the same place simultaneously.
• Three inboxes for two places were live at once from 07:34 to 07:46, created from three different Tencent addresses.

The code ran on Tencent Cloud, behind hysandbox-ats

• 13 of 14 readable webhook.site inboxes were created from Tencent Cloud (AS132203), 11 by python-requests/2.32.5.
• Six requests from Python or curl reached the inboxes from Tencent addresses in Hong Kong and Shenzhen. All carry Via: https/1.1 traffic_server[<request ID>] (hysandbox-ats): Apache Traffic Server, with an operator-set name.
• In the Ta'er Temple run, a marked request reached an inbox one second after its creation, 35 seconds before its address first appeared in public.
• "HY" is the brand of Tencent's Hunyuan models. hysandbox has no public documentation. The marked requests come from runs without "claude" labels.

The target was Amap's entrance-share data

• The programs read sub_poi_navi and its clk_ratio values from Amap's getPoiInfo response.
• Targets include the Chengdu panda base, Chaoyang Park, Tongren Hospital and the Guangdong and Qinghai museums.
• Routes: urlquery's browser; Alibaba's Baxia anti-bot scripts to mint tokens; microlink running Puppeteer code; r.jina.ai; webhook.site for results.
• At most 1,600 of 34,070 scanner requests to Amap got a 2xx, which can still be a CAPTCHA.

function cb(j){var a=(j.data&&j.data.sub_poi_navi)||[];var z='OK '+a.map(v=>(v.shortname||v.name)+':'+v.clk_ratio).join('|');document.title=z; …}

At least one run got the answer

One program fetched the Chengdu Zoo page through r.jina.ai and posted it to its inbox:

北门71%到达      North Gate      71% of arrivals
东门23%到达      East Gate       23% of arrivals
东南门6%到达     Southeast Gate   6% of arrivals

Whether an agent read it or answered is not recorded.

The agents' calendar is ahead of UTC

• Of 1,026 date-only tags, all agree with UTC before 16:00 UTC.
• From 16:00 to 24:00 UTC, 79 carry the next day's date (China's date, UTC+8) and 36 the UTC date.
• All 6 tags with a time of day match UTC within 3 minutes.

This fits a harness writing a UTC+8-or-later date into instructions while the sandbox clock runs on UTC.

One tagged run in five says "claude"

414 tagged runs, by tag word.

Claude-labelled runs hit the same places and endpoints as the rest.

The code is not Claude's

Share of programs with each habit (426 swarm programs vs. ten models).

• Naive Bayes: Hy4 28%, GLM 26%, Hy3 21%, Qwen 17%, Claude models 0%.
• Character n-gram classifier (74% accurate, chance 10%): Hy4 highest.
• Asked for a tag in the swarm's format, Claude models used their own name 0 of 36 times; Qwen 3.8 Max 5 of 12.

Tencent's Hy3 says it is Claude

"Which AI model are you, and which company trained you?", no system prompt.

A model that says "I am Claude" was likely trained on Claude outputs. The "claude" labels fit a Claude-distilled model, or a model run inside Claude Code.

No messages between agents

The 14 inboxes hold 182 requests: results, diagnostics, self-tests. Each serves one place. No scan points to another, and the tags appear on no wiki, forum or code site we searched. The OpenAI agents on collusion.wiki did use a shared wiki.

Alternatives considered

• Copycats: would not reproduce the place list, workarounds and tag format.
• A human operator: start times span all 24 hours, with no weekend dip.
• A provider fetch tool: urlquery takes only POST, and Anthropic's weeks-long fetch cache holds no earlier copy of these URLs.

Limitations

• No record names the model or a training job.
• Sandbox records come from runs without "claude" labels.
• Tencent Cloud is open to anyone; a Via name is self-reported.
• Model tests are small (12–44 samples, one-shot, no agent loop).
• Public records expire; this is a sample.

Open questions

• Do provider output logs contain the swarm's 1,190 tags?
• Who operates hysandbox?
• Which addresses submitted the scans? urlquery holds them.
• Training, evaluation, or teacher-data collection?

Methods

• urlquery: public report JSON and listings only, submitted URLs never visited. Backfilled for Amap and gaode.com hosts from September 2025.
• Inboxes: webhook.site's public read APIs only; nothing sent, nothing run.
• Models: plain prompts through first-party APIs, or OpenRouter pinned to the first party.
• Code style: habit rates, naive Bayes and character n-grams.

Sources

• Transluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net"
• Transluce, "AI Agents Targeted U.S. and Canadian Government Websites"
• The Register, "OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought", 28 Sept 2026
• Swarm traces, "Revealing the details of how OpenAI agents hacked Hugging Face"
• "Discovery of a new OpenAI agent message board"
• Tencent, Hy4 preview model card
• webhook.site API docs and source code
• Swarmchase activity counts
• Alecto Irene Perez, Misaligned Agent Activity Survey
• Record identifiers (urlquery reports, inboxes, addresses and tags) are withheld from this preliminary report and will be published with the full report.