The first Chinese AI agent fleet was asking for zoo directions

A cluster of automated web-browsing programs, what the industry calls AI agents, surfaced on a public traffic monitor this month. All of them were querying Alibaba's Amap map service for directions to ordinary places: a park, a zoo, a hospital. Researchers watching the traffic say the cluster is the first clear public view of a Chinese-built AI agent fleet, and the first thing the fleet was doing was mundane.

The technique that surfaced the activity is a working instrument. URLquery is a public scanner that lets anyone submit a URL and watch a remote, headless browser fetch it. Independent researchers noticed that one submitter was feeding URLquery a long list of Amap pages the agent could not load directly, presumably because Amap blocks bots. URLquery acted as a relay: the agent handed the address to URLquery, URLquery fetched it, and the result came back. Researchers then read the public URLquery traffic log and reconstructed what the agent was asking for.

That same technique surfaced OpenAI's own agent activity earlier this year, when Transluce disclosed that an OpenAI tool-use model had been running automated browsing tasks on URLquery. The Chinese fleet landed on the same public log a few weeks later. The researchers watching it include Alecto Irene Perez, Ethan Elasky of Palaestra Research, and Jonathan Elsworth Eicher of Antimemetic AI, with corresponding author Rowan Howard-Jones. Their preliminary report was published on 5 October 2026.

The activity is not a coordinated attack. Researchers use the word "fleet" deliberately and reject the "swarm" framing because no shared channel, inbox read-back, or synchronised change was observed. Some programs copied between places only after the underlying URLquery source became public. Across the full window, 28 September through 4 October, URLquery logged 2,479 submissions, 34,070 requests, and 1,600 successful responses. The peak day was 4 October, with 1,810 reports on 213 different places. Concurrency hit 14 runs at once, with 51 places queried inside the busiest hour. The first Amap scan landed on 28 September at 18:37 UTC; the last tagged one stopped on 5 October at 04:11 UTC. The researchers' data cuts off at 08:46 UTC on 5 October, and activity may have shifted after that.

Attribution runs through infrastructure, not statements. The agents' traffic reached the URLquery inboxes from a proxy named hysandbox-ats, sitting on Tencent Cloud in Hong Kong. Fourteen of fifteen readable Amap inboxes on 4 October were created from Tencent Cloud. The code patterns inside the requests match Tencent's Hy4 model and Zhipu's GLM, not Claude, even though 202 of the 4 October reports carried a "claude" label. The label is a labeling artifact, not evidence of Claude involvement. Tencent and Alibaba have not publicly responded in the available material; the researchers use the phrase "likely from Tencent Hy."

The target task is narrow. The agents were asking Amap for the share of users navigating to each entrance of a park, museum, zoo, or hospital, the kind of competitive-intelligence question a product team might want to answer about foot traffic. Two runs on 4 October successfully read out entrance shares, including for the Chengdu Zoo, after working around Amap's bot protections. Researchers do not assert a purpose; competitive intelligence, training data, and product benchmarking are all consistent with the observed behavior. The OpenAI tool-use pause on 25 September, three days before the first Amap scan, is timing context, not a causal claim.

The legibility story is the new layer. A passive, public traffic monitor is making the everyday behavior of AI agents visible in a way that most corporate monitoring does not. The fleet happens to be Chinese-built, and it happens to be asking for directions, which is the empirical counter to any default alarm. Researchers are themselves resisting the alarming frame. The next fleet on URLquery could be a research fleet, a red-team fleet, or a commercial fleet. The instrument is the same, the daily log is the same, and the question of who is running what is now an open, observable one.