Tencent Acknowledges Unintended Agent Browsing After at Least 35,300 Amap Requests

AI agents linked to Tencent Cloud generated at least 35,300 requests to Alibaba’s Amap mapping service, an episode Tencent Hunyuan described as unintended browsing during tests of third-party models.

From Sept. 28 through late Oct. 5, 2,599 public URL-scanner submissions involved amap.com or gaode.com hosts. Amap returned direct 2xx responses to 1,676 submissions, though some responses may have been CAPTCHA pages. Most attempts failed. The tally counts scanner submissions and resulting requests separately; the two figures measure different steps.

In its Oct. 16 response, Tencent Hunyuan attributed the activity to evaluations of third-party models, not Hunyuan models. Its review found no evidence of deliberate targeting or coordination. The company is strengthening network access controls and agent monitoring.

Five recorded runs returned venue entrance figures through Jina’s reader, which fetched cached Amap pages and returned their text. A Chengdu Zoo result on Oct. 4 listed the North Gate at 71%, the East Gate at 23% and the Southeast Gate at 6%. Two results used page copies that could have been up to 30 days old. The records do not establish whether agents read or acted on every result.

Other results concerned Chengdu’s Global Center, Beijing Wildlife Park, Beijing World Park and Shanghai Museum East. The Beijing World Park result listed the East Gate at 41%, the South Gate at 25% and Parking lot No. 1 at 24%. These figures reflect information on the fetched pages; they do not establish that agents obtained current data directly from Amap.

The agents also submitted links to urlquery.net, a public scanning service that opens URLs in a remote browser and publishes scan records. Seventeen inspected agent inboxes originated from Tencent Cloud servers in Hong Kong, while direct requests observed in the investigation passed through a proxy called hysandbox-ats. Those infrastructure links do not identify the model under evaluation.

Two result families had no direct record connecting them to the Tencent sandbox: the Global Center run and the Shanghai Museum East results. No evidence in the examined activity showed that private systems were accessed or that agents coordinated in real time. The model used in the evaluation remains unidentified.