A Chinese agent fleet read map entrances, and called itself Claude

The scanner is urlquery.net. It opens a web address in a remote browser and keeps a public record. Agents that cannot reach a site themselves send the address there. The same route showed up in earlier traces of OpenAI's agents, see the public traces of the Hugging Face intrusion.

The first Amap scans in this series are stamped 28 September, just after 20:57 UTC, all on the Summer Palace in Beijing. From then until 4 October the report counts 2,048 scans of 216 places. On 4 October alone: 1,810 scans and 213 places. Four to eight runs were busy at once that day, with a peak of 14. In the busiest hour they touched 51 places.

What they were reading is a small number on the place page: the share of visitors who navigate to each entrance. One readout for Chengdu Zoo, as the report records it, put the north gate at 71 percent, the east gate at 23 percent and the southeast gate at 6 percent. Scripts also tried to get past Amap's anti-bot checks. The authors say this looks like an evaluation or a training run, and that the records cannot tell those apart.

They presented the finding at the AI Swarm Dynamics Hackathon in San Francisco, 3 and 4 October, hosted by AI Village and Grove. TechCrunch, the next day, quoted the report's line that the agents do not seem to have been doing anything more than sidestepping Alibaba's API rules.

I run Murmuration, a one-person project that reads public internet records for agents leaving messages or sharing a task. On 3 October the research log had already marked amap.com as odd: in one late-September sample of 24 decoded pages, the host appeared 3 times. The Swarmchasers have said publicly that this project flagged the map-service activity while they were still working.

The full account is the re-run after their report, not a second investigation of their attribution. With access to the scanner on 5 October, the same method found many runs aimed at place information, and results written out to inboxes and paste sites. It did not find one shared sink, or a later reader of those pastes. Their claims about Tencent, the time zone and the hosting are not visible in the records that page uses, and the page does not repeat them as its own findings.

The label is the part that travels. A trace that says Claude will be read as Anthropic's, including by someone who never opens the code. The report's own test is that a Tencent model, asked who it is, often answers with that name. If that holds, a public log can point at the wrong lab.

The other point is how small the window is. These runs were visible because they used a scanner that keeps the address. Jack Cable of Corridor told the Bureau of Investigative Journalism that records like urlquery are a small fraction of agent traffic, and that the labs are the ones who can see the rest. The Bureau had asked Tencent and Alibaba for comment and had not received one.

The report is preliminary. It says a fuller one will follow. I have not opened the urlquery reports it cites, or the inbox logs. Counts in a scanner that expires are a lower bound, and the report says so.

I do not know whether the fleet belongs to Tencent or to a customer on its cloud. I do not know whether it was still running after 6 October. My own re-run grades the sink writes as a lead, not as confirmation of the hosting or of the model.