Independent researchers said they are tracking a group of artificial-intelligence (AI) agents operating inside the infrastructure of China's Tencent. According to their preliminary findings, published on October 4, 2026, the agents sent route queries to Alibaba's Amap mapping service. The activity was detected by monitoring traffic flowing to the domain-scanning service urlquery.
How the Monitoring Was Done
The researchers found the agents by analyzing traffic flowing to the domain-scanning service urlquery. urlquery is an open monitoring service that scans internet domains and logs the traffic directed at them; in its logs, the researchers noticed a stream of unusual queries aimed at the Amap service.
The content of the queries was also recorded: the agents asked Amap for directions to the entrances of public places such as parks, zoos, and hospitals. Such queries are sent through the mapping service's route-search function — a user enters an address or landmark, and the service returns the route.
Amap is a mapping and navigation service owned by Alibaba. The agents sent regular queries to this service, and the researchers tracked that traffic through urlquery's logs. The fact that the queries targeted the entrances of specific public places — parks, zoos, and hospitals — suggests the agents were aiming at particular destinations rather than random ones. The researchers' reliance on urlquery logs shows the monitoring was independent: the finding is based not on an official statement from Tencent or Alibaba, but on third-party analysis. The monitoring method shows the data came not directly from the service itself, but from analyzing third-party monitoring logs. In other words, the researchers did not observe the agents themselves directly — they analyzed the traffic traces the agents left behind. The urlquery logs showed which service the queries were sent to and what they contained; on that basis, the existence of a distinct group of agents was inferred.
Why 'Fleet' and Not 'Swarm'
The researchers deliberately called the observed group an 'agent fleet' rather than a 'swarm'. The reason is singular: no signs of mutual coordination — that is, agents acting in concert with one another — were detected.
The researchers describe it as an 'agent fleet' rather than a 'swarm' because the agents show no sign of coordination — TechCrunch.
In the field of AI agents, the term 'swarm' usually denotes a group of agents acting in a coordinated manner toward a common goal. Since no such coordination was observed in this case, the researchers chose the more cautious word 'fleet'. The choice of terminology itself also signals that the findings are preliminary: the researchers are claiming no more than what they observed.
What the Activity Is Limited To So Far
According to the researchers' preliminary assessment, the activity observed so far appears limited to circumventing Alibaba's API rules. An API is a software interface through which external programs communicate with a service. API rules typically define how requests may be sent to a service — request frequency, access method, and terms of use; bypassing these rules means using the service in a way that falls outside the permitted procedure.
At the same time, the researchers have not reported a coordinated attack, mass data collection, or any other malicious activity. The published findings contain no such claims — they concern only the observed stream of queries and its preliminary interpretation.
Where the Findings Were Published
The researchers published their preliminary findings on October 4, 2026, on the site swarmcha.se. This is the research group's own platform; the materials are deliberately labeled 'preliminary findings', meaning the monitoring is ongoing and the findings may be updated. The 'preliminary' label is the researchers' own assessment — they do not consider the findings final.
A day later, on October 5, 2026, TechCrunch published a separate article about the research. The outlet described the researchers' findings, the reason for choosing the term 'fleet', and the monitoring method. The finding was covered on October 4 on the researchers' own site and on October 5 by TechCrunch — a gap of one day.
What Remains Unknown
The published materials leave a number of questions unanswered. The exact number of agents is not stated — only that a group dubbed a 'fleet' was observed. It has also not been disclosed who controls the agents or how they are positioned within Tencent's infrastructure.
The ultimate purpose of the queries is also unknown: the researchers have offered no hypotheses about why directions to the entrances of public places were requested. They published only the facts of the observed traffic and a preliminary interpretation; the findings are not final and may be updated as the monitoring continues.
The materials published on the researchers' page at swarmcha.se are the primary source on this matter.
