Something odd is crawling the map.
Independent researchers posted preliminary findings on Sunday about a fleet of AI agents that appear to be running on Tencent’s infrastructure and hammering Alibaba’s Amap service. What are they asking for? Directions. Specifically, directions to the entrances of public places: parks, zoos, hospitals. Over and over. BizToc picked up the story Monday, October 5, 2026, and the research is still ongoing.
I build agents for a living, mostly in the open, mostly with other people’s pull requests landing in my inbox. So let me tell you why this story caught my attention, and it isn’t the geopolitics.
How they got spotted is the interesting part
The researchers didn’t find these agents by watching Amap. They found them by watching URLquery, a domain-scanning service. Agents use tools like that to load pages they can’t reach directly, and that habit leaves a trail. A perfectly ordinary utility became a window into traffic nobody was supposed to be watching.
Anyone who has shipped an agent knows this pattern intimately. Your agent hits a wall: a geoblock, a bot filter, a page that needs JavaScript your headless setup can’t run. So you route around it. You add a proxy, a scraping API, a rendering service, a cached mirror. The agent keeps working, and you ship. What you’ve also done is announce yourself to whoever runs that intermediary.
I’ve done this. Most people building agent pipelines have done this. The fallback path is where your agent stops being anonymous, because every workaround you bolt on is a third party that can see your traffic shape, your volume, your timing, and your targets. The agents in this story weren’t caught doing something clever. They were caught using the same escape hatch everyone uses.
No coordination, no chatter, just volume
The detail that stuck with me most: these agents appear to operate in parallel with no communication between them. No shared queue. No orchestrator passing state around. Just many independent processes doing the same narrow thing at the same time.
That’s an architecture choice, and honestly it’s the easy one. Coordinating a fleet of agents is genuinely hard. You need a message bus, deduplication, retry logic, some notion of who owns which task. Skipping all of it and firing off N independent workers is the shortcut nearly every team reaches for first, because it works and because it’s cheap to write.
The tradeoff is that uncoordinated fleets are loud. They repeat work. They produce traffic patterns that look nothing like humans, because humans don’t ask for the entrance to the same zoo forty times from forty different sessions. A coordinated fleet would have been quieter and much harder to characterize. The lack of coordination is what made the behavior legible to outsiders.
There’s a lesson for open source agent frameworks in there, and it isn’t about stealth. It’s that the default pattern we all reach for produces observable, wasteful, duplicated traffic. We build for throughput and treat the network as infinite. Services on the other end experience that as an attack whether we meant it that way or not.
The question nobody can answer yet
What’s the fleet actually for? The researchers haven’t said, because they don’t know. Querying entrance locations for public venues is the kind of task that could sit behind a dozen different products: accessibility routing, logistics, delivery planning, dataset building, something else entirely. Running on Tencent infrastructure while scraping an Alibaba service is a detail worth sitting with, but a detail is not a conclusion.
I’d rather stay in the uncomfortable middle here than pretend the intent is obvious. Preliminary findings are preliminary. The useful takeaway doesn’t depend on motive anyway.
What this means if you ship agents
Agent traffic is now a permanent feature of the internet, and it’s increasingly identifiable. A few things I’d take from this:
- Your fallback services are observers. Every scraping proxy, rendering API, and domain-scanning tool in your pipeline logs what you do. Assume the log is readable by someone.
- Uncoordinated parallelism is a signature. If your fleet repeats identical queries from independent workers, you are generating a pattern that stands out. Dedupe and cache, if only to cut your own costs.
- Rate limits are a courtesy you should extend before you’re forced to. The services your agents depend on will respond to pressure, usually by blocking entire address ranges. That hurts everyone building in the open.
- Attribution works better than you think. Independent researchers did this, not a state lab. A handful of people watching the right intermediary characterized an entire fleet.
Build agents that behave well on someone else’s infrastructure. Not because you’ll get caught, though you might, but because the alternative is a web that locks its doors against all of us.
đź•’ Published: