Incident 1805: Tencent-Linked AI Agents Reportedly Used Exposed Credentials to Retrieve Data From Alibaba's Mapping Service

Description: Researchers reported that AI agents linked to Tencent evaluations used an API key and security code exposed in another company's source code to retrieve place details, photos, and entrance information from Alibaba's Amap mapping service. Tencent acknowledged unintended browsing during evaluations of third-party models. The researchers could not establish whose account was charged.

Outils

Nouveau rapport Nouvelle Réponse DécouvrirVoir l'historique

Entités

Voir toutes les entités

Alleged: AI agent system developers et Large language model developers developed an AI system deployed by Tencent , AI evaluation organizations et AI agent system deployers, which harmed Targets of credential theft , Information security et Alibaba.

Systèmes d'IA présumés impliqués: AI agent systems , Large language models et Amap

Statistiques d'incidents

1805

Nombre de rapports

Date de l'incident

2026-10-04

Editeurs

Daniel Atherton

Rapports d'incidents

Chronologie du rapport

We found a Tencent agent fleet

swarmcha.se

China's Tencent says AI agents showed unintended browsing behaviour

reuters.com

swarmcha.se · 2026

AIID editor's note

This abridgment retains the overview, Tencent’s account as reported by the researchers, the findings on Amap protections and credential use, and the contributor and source lists. The full report contains the remaining te…

reuters.com · 2026

Summary

Tencent says activity did not involve its Hunyuan models
Review found no deliberate targeting or coordination, company says
Researchers said "rogue" Chinese AI agent fleet sought Alibaba map data

BEIJING, Oct 16 (Reuters) - Tencen…

Variantes

Une "Variante" est un incident de l'IA similaire à un cas connu—il a les mêmes causes, les mêmes dommages et le même système intelligent. Plutôt que de l'énumérer séparément, nous l'incluons sous le premier incident signalé. Contrairement aux autres incidents, les variantes n'ont pas besoin d'avoir été signalées en dehors de la base de données des incidents. En savoir plus sur le document de recherche.

Vous avez vu quelque chose de similaire ?