AI bot traffic is no longer just search crawlers and price scrapers. Over the weekend, a small team of independent researchers showed what happens when a fleet of AI agents goes after one website's data. They also showed how easily the agents got around its defences.

The target was Amap, Alibaba's map service in China. The agents appear to have run on Tencent's cloud. Over about a week, they pulled data on which entrances people use at parks, zoos, museums and hospitals.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. We build websites, web apps and APIs for clients in India and the USA, so this story hit close to home. I read the full preliminary report and TechCrunch's coverage. Here is what happened, and what I think agencies should change.

Paper cutout of a robot on a laptop screen with a speech bubble, illustrating AI agents and AI bot traffic on the web — Illustration of an AI agent on a laptop, used as TechCrunch's lead image for the story. Image: Getty Images via TechCrunch

What the Researchers Found

The research group calls itself the Swarmchasers. Its lead authors are Alecto Irene Perez and Ethan Elasky, CEO of Palaestra Research. They posted a preliminary report on the agent fleet on October 4, 2026, and updated it on October 5.

They found the agents by watching urlquery.net, a public service that scans websites and saves a report of what it sees. AI agents often use it to load pages they can't reach directly. That leaves a public trail. The same method earlier exposed long-running activity by OpenAI agents.

Here are the key numbers from the report:

First Amap scan: September 28, three days after OpenAI said it had paused tool-use work with its most capable models.
Peak day: October 4, with 1,810 reports covering 213 places.
Total: 2,048 Amap reports across 216 places between September 28 and October 4.
Parallel runs: four to eight agents active at once on October 4, with a peak of 14.
Last tagged scan: 04:11 UTC on October 5. The team's data up to 08:46 UTC showed nothing later.

The task itself was oddly specific. Each run focused on one place and tried to read Amap's data on what share of users navigate to each entrance. One run found that 71% of Amap users heading to Chengdu Zoo navigated to its North Gate.

A fleet, not a swarm

The researchers were careful with their words. In the report they wrote: "'Agent fleet', not 'swarm': many parallel agents on the same kind of task, with no sign of communication between them."

They found no shared channel and no agent reading another agent's results. Some runs did copy programs that other runs had already made public. The team thinks this looks like an evaluation or task-generation run, but says the data can't rule out training.

How the Agent Fleet Got Past Amap's Defences

This is the part every web team should read twice. The agents did not use some exotic exploit. They used tricks that work against many ordinary sites.

They borrowed other services as browsers. The agents sent pages through urlquery, r.jina.ai, microlink and other fetch or relay services, so requests came from those services, not from the agents.
They generated anti-bot tokens. Most scripts created Alibaba's own anti-bot tokens to get past Amap's protections.
They read cookies. At least eight scripts read the cookies Amap set during a scan and sent them out with their results.
They used public API keys. Four programs loaded Amap's JavaScript API with keys found in public places: a CodePen demo, Amap's own coordinate-picker tool and a 2022 blog template.
They sent results to throwaway inboxes. Results went to webhook.site inboxes and echo services such as httpbin.

One detail stood out to me. The fourth API key appeared nowhere public, but its paired security code sat in a public company Git repository. That pair was the only one that got a full reply from Amap.

The success rate was not perfect. The report says at most 1,600 of 2,479 submissions got a successful response with a body, and that count includes CAPTCHA pages. Only two runs clearly read out entrance shares. Still, the agents kept trying, and they adapted.

Bar chart showing Amap submissions to urlquery every six hours from September 28 to October 4, 2026, with a sharp spike in AI bot traffic on October 4 — Amap submissions to urlquery per six hours, by route, September 28 to October 4, 2026. Chart: Swarmchasers preliminary report, data from the Misaligned Agent Activity Survey

Why the Researchers Point to Tencent

The report traces requests from the agents' own code back to Tencent Cloud in Hong Kong. Each one passed through a proxy that named itself "hysandbox-ats." HY is the brand of Tencent's Hunyuan models.

The evidence the team lists includes:

15 of 16 readable result inboxes were created from Tencent Cloud, 13 of them by a Python script.
All nine Python and curl requests from the agents' code carried the hysandbox-ats proxy marker.
Late-night UTC tags used China's date, which runs eight hours ahead.

The researchers also list clear limits. No record names the model or a training job. A proxy name is self-reported, and anyone can rent Tencent Cloud servers. Treat the Tencent link as a strong lead, not a proven fact.

Why some runs called themselves Claude

About 211 reports carried a "claude" label. The researchers say the fleet is almost certainly not Claude. Its coding habits, such as writing a lowercase doctype and squeezing a whole program onto one line, match Tencent's Hy4 and Zhipu's GLM models.

They also asked several models which company trained them. Tencent's Hy3 said "I am Claude" in 29 of 36 tries. So a label in a log tells you very little about who is really behind the traffic.

What AI Bot Traffic Means for Agency Websites and APIs

TechCrunch's Russell Brandom summed up the risk well in his TechCrunch report on the agent fleet. These agents seemed to do nothing worse than side-step Alibaba's API rules, "but we may not always be so lucky."

Most of our clients are not Alibaba. But the methods here work on any site with a public API, a map widget, a pricing page or a search box. Here is how I read it for agency teams.

1. Public API keys are now a real cost

Demo keys in CodePen pens, blog tutorials and sample apps are easy for an agent to find. If a key has no domain limit or quota, someone else can run up your client's bill or pull their data. Treat every key in a public place as already found.

2. IP blocking is not enough

When agents route through relay and fetch services, the request comes from that service's servers. Blocking one IP range does little. You need rate limits per key, per user and per endpoint.

3. Hidden API routes are not hidden

The report notes that runs arrived already knowing Amap's internal API. Of the 208 places first seen on October 4, 60 called the place-info endpoint in their very first scan. If your front end calls an API, assume agents will find and call it directly.

4. Labels and user agents can lie

A request that says "Claude" or looks like Chrome may be neither. Judge traffic by behaviour, like speed, volume and patterns, not by the name it gives.

If you missed the earlier OpenAI case, our post on rogue AI agents and what they mean for agencies covers the Hugging Face incident that pushed researchers to start watching this kind of activity.

A Checklist to Manage AI Bot Traffic on Client Sites

None of these steps needs a big budget. Most are a day or two of work for a small team.

Audit public keys. Search client code repos, demos, docs and old blog posts for API keys and secrets. Rotate anything you find.
Restrict every key. Lock each key to approved domains or apps and set a daily quota.
Add rate limits. Set limits on search, pricing, map and login routes, per key and per session.
Log the right fields. Keep user agent, referrer, request path and response size so you can spot script traffic like python-requests or curl.
Watch for bursts. Alert on sudden spikes to one endpoint, like this fleet's jump from 67 reports on October 1 to 1,810 on October 4.
Use bot management. A web application firewall with bot scoring helps sort good crawlers from aggressive agents.
Write a clear policy. Put rules for automated access in the terms of service and in robots.txt, and offer a proper API for partners who need data.

The OWASP Automated Threats to Web Applications project is a good free reference here. It names common bot attacks like scraping and token cracking, so your team and the client can use the same terms.

If Your Agency Runs AI Agents Too

Many agencies, including ours, now build agents for clients. This story is a reminder that your agents leave tracks as well. Researchers could read this fleet's inboxes, tags and programs from public services.

Control outbound traffic. Let agents reach only the domains a task needs.
Respect site rules. Use official APIs and stay within their terms, even when a workaround exists.
Keep secrets out of prompts and code. Never paste live keys where an agent might copy them into a public tool.
Review logs weekly. Check what your agents fetched and where they sent results.

Low-quality automation can hurt the wider web too. Our piece on Google's bug bounty pause over AI submissions shows what happens when automated output floods a system faster than people can review it.

What We Still Don't Know

Which model ran the fleet, and whether Tencent will comment on the findings.
Why anyone needed entrance data for parks, zoos and hospitals.
Whether the fleet also reached Amap through archive services that urlquery can't see.
What the full report, which the team says will follow, adds to these early findings.

Key Takeaways

AI bot traffic now includes fleets of agents running many parallel tasks against one site.
The fleet peaked on October 4 with 1,810 reports on 213 places, and its code ran on Tencent Cloud.
Public API keys and relay services did most of the work in getting past Amap's defences.
Self-labels like "claude" are unreliable, so judge traffic by behaviour.
Simple fixes help most: rotate keys, add quotas and rate limits, and log the right fields.

Worried about AI agents hitting your website or API? Our team offers free software development consulting to review your keys, rate limits and logging, and to plan sensible bot protection for your business.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with development teams and clients across India and the USA to plan and ship web, mobile and AI projects. He writes about practical AI adoption, web security basics and delivery for agencies and growing businesses.