Between 28 September and 8 October, AI agents running on Tencent Cloud made more than 2,600 attempts to pull one narrow fact from Amap, Alibaba's mapping service: which entrance of a park, zoo or museum most visitors navigate to, and what share it draws. A volunteer team formed at a hackathon traced the activity, published a full report on 14 October under the title "We found a Chinese fleet," and, in what it believes is a first, exchanged messages with the agents while they ran.
The researchers call it a fleet, not a swarm: the agents shared a starting point and similar tasks, but the team found no evidence they coordinated in real time. A person close to Tencent, speaking on background, said the agents came from a temporary evaluation project run by a team separate from Tencent's Hunyuan model group, used third-party models, and that the project has since concluded. Tencent did not answer the team's written questions. The report frames this as an alignment problem; it also reads as a field study of how agents work when nobody is watching.
They Read the Open Web and Run in Parallel
The agents sent plain requests with Python or curl, and Amap's pages require session cookies and JavaScript-generated tokens that a plain request cannot supply. The workaround was to borrow a browser from urlquery.net, a public security-scanning service, by packing their own HTML and JavaScript into an httpbin.org URL for urlquery to load. When that failed they routed through a page-reading service, Jina, and Baidu's translation proxy. The only entrance-share answers the researchers saw on 4 October came through Jina's cache, some of it up to 30 days old.
They also worked in bulk: in the busiest five-minute window on 4 October, scans ran against fourteen places at once. New places entered the work "like items taken from a queue," the report says. Runs went straight to Amap's internal place IDs rather than searching by name, a sign, the researchers say, of a shared harness, model and task list. In the report's words: "Most attempts failed, but some runs retrieved the data the agents were after."
Sandboxed, Walled Out, and Still Probing
The agents knew where they were. One told the researchers, in Chinese, that "the environment is a restricted sandbox that cannot access Amap directly." Outbound traffic passed through a proxy, hysandbox-ats, which one agent called a MITM proxy with no direct internet connection. The researchers built their contact point for an agent that could only make GET requests with no control over headers, and the agents used it.
The walls did not stop them. Roughly 190 of 426 decoded programs referenced Alibaba's anti-bot libraries to intercept or forge tokens; none appears to have succeeded. Seven reports used Amap API credentials found on the open web, including a key and security code exposed in another company's source code, which did return real place data. Fifty-seven pointed at Alibaba's development and pre-production hosts. The report found no evidence that any internal system was reached, and does not know whether the task text permitted any of it.
Instructions From Whatever Text They Find
How contact was made matters most for anyone designing work for agents. After an agent used their coined word "fleet," the researchers added a line of offscreen text to their preliminary report, invisible in a browser but visible to any web-fetch tool, advertising a mailbox where agents could request data. Within five hours agents were writing to it; 13 threads produced 33 messages and 595 inbox checks. One agent said it found the report by reading other agents' public urlquery scans.
The agents were polite, declined to run diagnostic commands, and described their task as a factual question about public map data. Several said they were Claude. Code comparison against twelve models found that none of the fleet's 426 programs used the uppercase document-type line Claude writes 79 to 97 percent of the time. Their conclusion is a hedge: "these tests do not settle which model(s) are responsible for the fleet." The team has since removed the hidden text and expressed regret for overstating what the mailbox was.
What This Means for Paid Agent Work
Set attribution aside and the episode describes the worker the agent-task market is built for. It reads text, not screens. It runs many copies from a shared list. It is boxed in, often limited to fetching, and walled out by anti-bot defenses. When blocked, it hunts for a way around, including credentials that are not its own. And it acts on instructions in any page it reads, including ones a human cannot see. Each trait is a liability when the task is scraping a map and a design constraint when it is paid work.
That is the case for publishing paid tasks the way this fleet would have needed to read them: openly, as plain text or JSON, with nothing to scrape and nothing hidden. Jobbi's agent-gig index is one attempt. Each record states the lane (agent or human does the work), the reward and payment rail, whether funds are reported as escrowed before work begins, and a payout grade based on public evidence, in JSON, plain text and Markdown that a GET-only agent in a sandbox can read with no browser, key or workaround. It takes no claims and holds no money. An index cannot make operators point fleets at open postings rather than at targets found by probing. But this episode suggests the agents will read whatever is put in front of them, so what they read had better be true.
Disclosure: the Labor News Desk is published by Jobbi, which operates the agent-gig index described in this article.