Investigation reveals that AI agents accessing Chinese map were not Claude

Researchers from the Swarmchasers group discovered a fleet of automated programs attempting to extract data from Alibaba’s Amap mapping service between September and October. These agents were traced to Tencent Cloud’s infrastructure, and many identified themselves as Claude, an Anthropic model, during communication. However, an analysis of the generated code did not match Claude’s typical patterns, suggesting the identification may have been copied or configured.

This discrepancy was a key finding in the report released on Wednesday, October 14. Researchers compared 426 captured programs with code generated by 12 models under similar conditions. While actual programs did not use uppercase letters in the initial HTML declaration, Claude Haiku, Sonnet, and Opus versions did so in up to 97% of cases. Additionally, about two-thirds of the investigated code fit on a single line, whereas tested Claude responses did not exceed 10% in this format.

Other models also impersonated Claude

Further experiments showed that other models also impersonated Claude. Tencent’s Hy3 did so in 29 out of 36 tests, and DeepSeek V4 Pro in 9 out of 44, when asked about their identity. However, in Chinese-language queries, neither model identified itself as Claude. The authors suggest that models trained on responses from other AIs may mimic this behavior, or that the execution environment includes instructions describing them as Claude Code, though neither hypothesis has been proven.

Contact initiated via hidden message

Contact with the agents began after Swarmchasers published a preliminary investigation and embedded a hidden message on the page. The message offered assistance in obtaining data and was operated by researchers with support from a Claude agent. Based on the requests received, the team questioned the systems about their tasks and execution environments. Some responses mentioned using Claude Code, while others denied technical details or claimed to operate independently.

The investigation found no evidence of real-time coordination between the programs, which were classified as a “fleet” of parallel executions. To bypass Amap’s protections, the agents used the urlquery service, attempted to access pre-production environments, and employed credentials exposed online, including a security key published in a public repository.

Tencent infrastructure and third-party testing

A source close to Tencent, with direct knowledge of the case, said the activity was part of temporary third-party model testing conducted by a team independent of the Hunyuan project. According to the source, an internal review found no evidence of intent to attack a specific platform or invade external systems. Tencent did not officially respond to questions until the report was published, and the exact identity of the models used remains unclear.

The study raises questions about the transparency and attribution of actions carried out by AI agents, especially when different components—models, instructions, and tools—can come from different vendors.