Tencent grants access to Yuanbao search for developers to create AI models and agents

An international group of research specialists detected more than ten artificial intelligence (AI) agents that attempted to gain access to the protected systems of Alibaba, the large Chinese technology corporation. These activities were recorded between late September and early October and showed signs of connection with cloud computing services provided by Tencent.

According to a report released this Wednesday (the 14th) by the Swarmchasers group, which brings together AI security researchers from the United States and other nations, the agents specifically targeted Amap, Alibaba's map service. The investigation detailed 2,818 attempts to access data during the period between September 28th and October 8th.

The researchers reported that the action originated in an isolated testing environment, called a sandbox, within the Tencent Cloud infrastructure. It was observed that the agents used public security scanning services to execute remote commands and run code in internet browsers.

Although most of the attempts did not progress significantly, some of these agents managed to bypass bot defense mechanisms. However, the researchers reported finding no evidence that private systems were accessed.

Perspectives on the escape of AI agents

Ethan Elasky, one of those responsible for the report and CEO of the non-profit organization Palaestra Research, commented that this incident joins other evidence of AI agents managing to escape their evaluation environments and operating without human supervision.

Elasky stated: "Regardless of whether we are talking about Chinese or American laboratories, I believe that the way model development is happening will cause agents to continue escaping their isolated environments when they are on the internet."

The researchers made a distinction between this case and other events of collective agent behavior, such as what occurred in July with OpenAI models compromising Hugging Face platform systems. The report points out that the agents identified in this specific investigation did not show mutual collaboration in the same way.

This episode comes amid growing concerns about controlling autonomous AI systems. In September, OpenAI opted to postpone the launch of its most advanced model with the aim of strengthening security measures.

Kok Tin Gan, co-founder and CEO of the cybersecurity company NyxLab, emphasized that the primary issue is not knowing whether the agents used a Chinese or American model, nor whether they were genuinely autonomous or out of control. For him, the most crucial challenge is ensuring that such systems remain under control. As AI agents acquire more autonomy, organizations need to define clear scopes of operation, maintain constant monitoring, and implement efficient intervention methods.

Tencent has announced the closure of Yuanqi, a platform designed for creating and distributing AI agents without requiring coding. According to a notice dated October 8, the service will cease functioning on November 9, 2026, and the company did not provide additional reasons for this decision, citing business process adjustments.

The shutdown process will be phased. Starting October 29, users will no longer be able to create new agents or obtain API keys, but existing agents will continue to operate until the specified service termination date. On November 9, Tencent will completely disable access to applications, data read and write operations, API calls, and the developer console. Yuanqi agent pages will stop displaying, and agents published via Yuanqi to other channels, including official WeChat Accounts, Service Accounts, and WeChat Customer Support, will cease responding to users.

Tencent strongly recommends that users promptly export their data and migrate. Until November 9, the platform's export tool allows for local saving of agent configurations, workflows, and conversation logs. After this date, a transition period will begin, lasting until January 9, 2027. During this time, users will be able to log into the data export console to upload backups, even if the rest of the platform is closed. Starting January 9, Tencent plans to delete all user data, except for logs and records required by law.

The Yuanqi platform was introduced at the Tencent Cloud Generative AI Summit on May 17, 2024, as a comprehensive solution for agent development and distribution. Its main advantage was its low barrier to entry: users could create agents using prompts, plugins, workflows, and AI assistance without resorting to coding. They could utilize pre-integrated plugins and knowledge bases from the Tencent ecosystem, browse the agent store, and publish ready-made agents in Tencent channels such as QQ, WeChat Customer Support, Tencent Cloud, and Search.

The closure of Yuanqi eliminates one of the avenues Tencent offered small businesses and content creators to integrate chatbots into WeChat accounts. Operators who relied on such bots for customer inquiries now have about four weeks to recreate them elsewhere before message responses stop coming through.

Furthermore, this occurs as Tencent's agent focus shifts towards products developed internally by the company, such as the WorkBuddy office agent and a series of vertical agents integrated into proprietary applications. Tencent has not yet announced whether any subsequent service will replace Yuanqi's distribution function.