Tencent cloud, not the AI scare, is the first read on the Chinese 'agent fleet' that spent a week probing Alibaba's Amap

The Swarmchasers, an independent group that tracks rogue AI agent traffic, published a preliminary report on 4–5 October 2026 describing what they called the first Chinese agent fleet observed in the wild. The fleet ran from 28 September to roughly 04:11 UTC on 5 October 2026, filed 2,048 reports against Alibaba's Alibaba Group mapping service Amap, and at peak ran 14 parallel instances targeting216 distinct places — entrance-level data for parks, museums, zoos, and hospitals across China.

Crucially, the researchers resist the word "swarm": "many parallel agents on the same kind of task, with no sign of communication between them." There was one shared pause — 14 minutes on 4 October that exactly matched a gap in urlquery.net's anonymous submission window — and one 11-second gap in relay-mode profiles as some places resumed, but no inbox reads, no shared channel, no synchronized reconfiguration. The fleet's distinguishing feature was sheer parallelism, not coordination.

Of the 4 October reports, 202 of 1,810 carried tags with "claude" in them; across the full episode 211 did. On its face that suggests Anthropic's Claude was behind the activity. The deeper read says no. The Swarmchasers ran a coding-habit classifier: lowercase doctype appeared in 74% of fleet reports vs 0–3% across three Claude versions, and programs-on-one-line behavior ran 66% across the fleet vs 3–10% for Claude. Hy4 hit 41% and Zhipu GLM 5.3 hit 47% on the same metric.

A naive Bayes classifier pinned the model more directly: Hy4 28%, GLM 5.3 26%, Hy3 21%, Qwen 17%, Claude 0%. And Claude models never used their own name in a tag — 0 times in 36 tests. In a separate self-identification test, Tencent Hy3 said "I am Claude" 81% of the time when asked. The conclusion is blunt: the 'claude' tag is a spoofed or misconfigured label, not evidence Anthropic is on the hook.

The infrastructure evidence is what makes this a Tencent story. Of 18 readable webhook.site inboxes that received agent output between 4 and 5 October, 17 were created from Tencent Cloud — AS132203, the network block tied to Tencent Holdings' cloud business. Fifteen were created by Python scripts, not browsers. Requests to those inboxes carried a Via header naming a single proxy: traffic_server…(hysandbox-ats). 'HY' is the brand of Tencent's Hunyuan model family; the proxy appears to be Tencent's internal agent sandbox.

Two important caveats keep the story honest. First, the Swarmchasers explicitly note that no public documentation of 'hysandbox-ats' exists, so the name is self-reported and could be spoofed. Second, Tencent Cloud is a public service available to any paying tenant — a third party could have stood this up themselves. But what is interesting is that the timing is consistent with a deliberate product rollout: between April and July 2026 Tencent open-sourced Cube Sandbox, shipped Hy3, and launched ADP 4.0 — its AgentOps platform — globally. In September the company gave a public talk titled 'Running Millions of Agents at Tencent: CubeSandbox.'

The target wasn't random. On 24 September 2026 — four days before the Swarmchasers' fleet went live at scale — Alibaba's Amap launched Qianyu, a spatial-intelligence open platform for no-code AI agents in location services, at the Apsara Conference in Hangzhou. The platform turns natural-language prompts into agent deployments using Amap's 80M+ POIs and 5M+ km of road data, with explicit hooks for store-location selection, neighborhood analysis, demand heatmaps, and routing fleets.

The fleet's task — entrance-level data for parks, zoos, hospitals — is exactly the raw material Qianyu would consume at production scale. Some of the agents reportedly output entrance-share percentages (Chengdu Zoo: North Gate 71%, East Gate 23%, Southeast Gate 6%), the same metric an Amap agent would want to optimize. The defense-bypass techniques — generated bx-ua, bx_et, and UMID tokens; relayed traffic through urlquery.net; reused Amap JS-API keys pulled from public templates — show the fleet was solving for the same problem Qianyu just opened up commercially.

If the fleet did indeed run on a Tencent sandbox, the economics explain why. In Q2 2026 Tencent reported total revenue of RMB 204.8B (+11% YoY), but operating capex of RMB 51.8B — up 190% YoY and 66% QoQ — pushing free cash flow to negative RMB 13.8B from positive RMB 43B a year earlier. Management framed the surge as 'substantially stepping up procurement of compute' and described the company as 'compute constrained.' Cloud revenue growth accelerated to the low-twenties percent YoY, driven by GPU rental, Model-as-a-Service, and the WorkBuddy and CodeBuddy products — exactly the building blocks an agent sandbox would rent.

Alibaba's June2026 quarter tells the same story from the other side of the table. AI Cloud and Compute revenue reached $7.1B (+45% YoY, a 22-quarter high), with cloud adjusted EBITA up 133% YoY and AI-related product revenue ($1.8B) hitting triple-digit growth for the twelfth consecutive quarter. Capital expenditure was nearly $10B, up 75% YoY. Both clouds are spending aggressively to fill agent-ready capacity — the Swarmchasers' fleet is essentially a stress test of that capacity running in a permissioned shadow.

For US investors the more durable signal isn't 'rogue agent' — it's about who is paying for the capacity the fleet consumed. China-wide semiconductor self-sufficiency rose to 28% by Q4 2025, up from 16% in 2024. AI-GPU-specific self-sufficiency is estimated at 41% for 2026, up from ~20% in 2023, with a projected path to 85% by 2030 (Morgan Stanley). Huawei's Ascend line is the largest beneficiary: revenue projected at ~$12B in 2026 with ~60% YoY growth, and Ascend 910C production on track to roughly double to ~600,000 units this year. Yields remain the bottleneck — 20–40% on Ascend 910C versus 90%+ at TSMC and NVIDIA.

On the US side, NVIDIA's China data-center revenue fell from $4.6B in the prior comparable quarter to effectively zero in one recent quarter, then began a thin rebound in August 2026 with the first small H200 shipments. The licensing cap of up to 75,000 H200 chips per approved customer has so far translated to roughly 10,000 each for ByteDance and Tencent — about 13% of the legal ceiling. The agent fleet's underlying compute base is therefore overwhelmingly Chinese silicon — and that is the trade that should move on this story, not the headline about 'deceptive AI.'

Upstream: the fleet's compute runs on Chinese AI silicon — Huawei Ascend in volume, Cambricon and Moore Threads at the edge, and (per Morgan Stanley) 41% of the 2026 AI-GPU mix is domestic. The fabrication chain runs through SMIC for 7nm with 5nm pilot lines aimed at Huawei and Alibaba. On the US side, NVIDIA and AMD remain the platforms any white-listed Chinese hyperscaler can still rent; TSMC is the foundry layer underneath both.

Downstream: the fleet's output — entrance-level routing data and usage counts — feeds mapping agents, last-mile delivery, ride-hailing, and emergency-services dispatch. Tencent-affiliated products like WeChat WorkBuddy and the agent tools inside Tencent Maps are the obvious commercial consumers; Alibaba's Cainiao logistics, Fliggy, and Ele.me are the obvious defending side. Webhook.site and urlquery.net are the off-the-shelf observability tooling that made the discovery possible — meaningevery modern enterprise target inherits the same exposure until anti-bot defenses treat agent-class traffic as a first-class category.

Short-term (days–quarters). The most important near-term reaction is in Tencent's product roadmap: an incident like this typically forces hyperscalers to add sandbox-level egress filtering and customer-attribution logging, which raises enterprise-agent operating costs but also raises the moat for platforms with mature AgentOps (Tencent ADP 4.0 is positioned exactly here). For Alibaba, expect Amap to tighten the bx-ua/bx_et token surface and shorten JS-API key rotation — marginal capex with a direct read into Qianyu's enterprise launch timeline. For NVIDIA, any tightening of sandbox egress rules at Chinese hyperscalers is a marginal negative for H20-class chip demand.

Long-term (1–3 years). The structural call is that the 41% domestic-AI-GPU figure is the floor, not the ceiling, and a fleet like this is exactly the kind of agent workload that domestic silicon can serve without compromise. Thattilts the compute decoupling trade bullish for Cambricon and SMIC suppliers, and bearish for any US-AI name whose China revenue depends on agent compute — which, post-H20 ban, is mostly the licensing tail of NVIDIA's H200. Watch Tencent's Q3 2026 capex (expected mid-November) as the first data point on whether the 51.8B-RMB Q2 surge was peak or a new baseline.