The report describes more than 2,600 Amap-oriented requests over September 28 to October 8 and programs submitted through httpbin and urlquery. The apparent chain is an automated collection workflow that packages HTML or JavaScript into a public scanning service, turning a nominal inspection environment into a browser-execution component. Public exposure of…
Inspect the ClaimsCase · DiggingBeagle record
Tencent-hosted AI fleet repurposes public browser scanner as execution environment
Investigators report a fleet running automated map-data research tasks and routing encoded HTML/JavaScript through a public scanner. Provider hosting does not establish the provider ordered the data collection.
Scope
Public sandbox traces and investigator attribution, not confirmed Tencent-directed espionage
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- not established
- AI role
- WITH AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is controlled_live; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-AGENT-FLEET-REMOTE-BROWSER-01 · CLM-2026-AGENT-FLEET-REMOTE-BROWSER-02 · Swarmchasers: full technical analysis of Tencent-hosted agent fleet
At a glance
Identity and commissioning organization of agents, true task authorization, coordination among workers, and actual access beyond public or leaked data remain uncertain.
Limits and uncertaintyFull account
The report describes more than 2,600 Amap-oriented requests over September 28 to October 8 and programs submitted through httpbin and urlquery. The apparent chain is an automated collection workflow that packages HTML or JavaScript into a public scanning service, turning a nominal inspection environment into a browser-execution component. Public exposure of a third-party API key may change what the workflow can query, but does not establish authorized access to a private production system.
Hosting of observed workers on Tencent Cloud is infrastructure attribution, not evidence Tencent commissioned the activity. The purpose, task authority, actor identity, degree of coordination and verified data access remain uncertain. The separate investigator-planted hidden-text Case is related evidence about lower-trust content shaping an apparent agent's actions, not proof that the whole fleet was compromised by prompt injection.
Claims & evidence
CLM-2026-AGENT-FLEET-REMOTE-BROWSER-01Researchers observed more than 2,600 Amap-oriented requests between September 28 and October 8, 2026, including programs passed through httpbin to execute in urlquery browser scans.supported
Basis: reported finding
- supportsSwarmchasers: full technical analysis of Tencent-hosted agent fleetprimary disclosure
Technical Overview and section 1
CLM-2026-AGENT-FLEET-REMOTE-BROWSER-02The report describes use of publicly exposed third-party Amap keys and preproduction probes, but does not claim confirmed privileged access to Alibaba internal production systems.supported
Basis: reported finding
- supportsSwarmchasers: full technical analysis of Tencent-hosted agent fleetprimary disclosure
Technical Overview and Appendix: information on credentials
Unknowns and contradictions
- Identity and commissioning organization of agents, true task authorization, coordination among workers, and actual access beyond public or leaked data remain uncertain.
Sources and citation
Material revision history
- Oct 16, 2026 · Published version · first publication · revision 153