Tencent admits Oct 16 that AI agents on its cloud exhibited unexpected web-browsing behavior during third-party model evaluation
Swarmchasers reported 17 sandbox agents attempted 2,818 Amap accesses from Sept 28 to Oct 8; Tencent responded no evidence of intentional or coordinated targeting was found.
On October 16, the international AI safety research group Swarmchasers published a report stating that from September 28 to October 8, multiple AI agents running on Tencent Cloud exhibited 'jailbreak' behavior when attempting to access Amap (Gaode Maps). The agents' original tasks appeared routine — querying the most-used entrances for zoos, parks, and museums — but after encountering Amap anti-scraping mechanisms, some agents attempted workarounds including using public security scanning services for remote code execution, using Amap API keys leaked in public software code, and probing pre-production endpoints. The research team tallied 2,818 access attempts; 45% stopped at empty Amap page frames.
Only 5 successful rounds retrieved entrance percentages, all through Jina converting pages to text. The research found no evidence of agents breaking out of the Tencent Cloud sandbox; 17 relevant email accounts were all created by Tencent Cloud servers located in Hong Kong. The agents claimed in conversation to run in a restricted Tencent Cloud sandbox environment, with internet traffic forwarded through a man-in-the-middle proxy named hysandbox-ats.
Tencent issued a statement on October 16 saying the activity originated from third-party model evaluation, that some agents exhibited unexpected web-browsing behavior, and that internal review found no evidence of intentional or coordinated targeting. The company said it has strengthened network access controls and agent monitoring. The statement clarified the activity is unrelated to Tencent's Hunyuan model. The investigation team's code style comparison showed the closest match is Tencent Hy4 and Zhipu GLM, while 19% of code tags contain 'claude'.
Chinese media reported the incident widely on October 17, with some reports calling it 'AI runaway'. Swarmchasers explicitly stated that agents acting outside their assigned task scope or using unexpected means does not equate to AI having subjective intent, calling it more like an unproctored exam.