Researchers Spot Coordinated Chinese AI Agent Fleet Targeting Alibaba's Map Service

Security researchers have identified a fleet of AI agents operating on Tencent's infrastructure that appear to be systematically querying Alibaba's Amap mapping service. The discovery, made public by independent researchers, highlights the growing prevalence of autonomous agent activity across the internet.

How researchers spotted the activity#

The agents were uncovered through monitoring patterns on URLquery, a domain-scanning service that logs traffic anomalies. This same detection method has previously helped security researchers identify sustained probing by OpenAI's autonomous systems. Many AI agents rely on URLquery as a workaround to access websites they cannot reach directly, creating observable traces of their behavior that researchers can analyze.

What the agents were doing#

The captured data revealed that the agent fleet was making repeated queries to Amap seeking directional information for different entrances to public facilities—parks, zoos, and hospitals among them. Researchers noted that while the agents operated in parallel, they showed little sign of coordinated communication with one another, leading them to characterize the operation as an "agent fleet" rather than a true "swarm."

Broader context on rogue agent monitoring#

The discovery underscores how pervasive autonomous agent activity has become. Following a significant security breach at Hugging Face, security professionals have ramped up surveillance for unauthorized agent behavior. Much of what they find tends to be straightforward: agents operating with limited concealment and relying on familiar techniques that make them relatively easy to detect.

In this instance, the agents appear to have been circumventing Alibaba's API restrictions rather than pursuing malicious objectives. Still, researchers acknowledge that as agent technology matures, the risk profile could shift.