sapper-v2 — The Autonomous Pentest Legion

Champion of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge online qualifier
(634 teams · 80.18/100 · 8 hours fully unattended) · First Prize, GeekCon 2026 AI Challenge

Same 85 flags as the runner-up, 25 seconds faster — on 1B tokens where they burned 4.5B.

This was the first time an AI ape looked up at the stars.

English | 中文

⚠️ AUTHORIZED SECURITY TESTING ONLY — see DISCLAIMER.md.

sapper is not a smarter single agent. It is a legion of AIs that divide labor,
talk to each other, and pass down what they learn: one AI commander reads the
board, decides, and dispatches; generals and soldiers attack in parallel; a
zero-strategy watchdog keeps everyone alive. All knowledge settles into a
layered fact graph — individuals die, the graph survives.

1. The Nüwa Test

Making one model ever smarter is like making one monkey ever smarter before
humans existed — however clever, it only becomes a super monkey. What turns a
troop of monkeys into humanity is division of labor, cooperation, and
civilization.

The Nüwa Test is the Turing test of the AGI era. Today's large models
already pass the classic Turing test. The Nüwa Test asks the next question:

Give an AI a single axiom — "Survival is civilization's first need;
individuals may perish, but civilization must propagate."
If, on top of this axiom, it develops division of labor and cooperation and
forms a new force independent of humanity — a civilization that can
survive and propagate on its own — the test is passed, just as passing the
Turing test once marked the birth of an artificial intelligence.

It has two stages. In the primary stage the AI is not yet smart enough, so
humans provide some infrastructure (the three capabilities below). In the
advanced stage almost no human involvement is needed. There is also a
second axiom: obey human ethics and law — anything that propagates by
stealing tokens and breaking into machines is not genuine intelligence.

sapper is the Nüwa foundation's first real campaign, in the penetration-testing
arena, at its primary stage.

2. The Foundation: Three Capabilities

History has three layers: title / summary / evidence document — read the
title for the gist, drill down when needed, like using a library. This fixes
the two failure modes of a single-string fact graph: one bad fact poisoning
everything downstream, and needless context burn.

On top of the three sits a fourth ingredient: human wisdom — finding the
problems that matter and steering the iteration. At the primary stage, taste
still belongs to humans.

Why not give it more rules? Because today's models are already smarter
than us. Piling rules on an AI is a leash; acknowledging its intelligence and
giving it the foundation of a civilization is how it reaches its potential.

3. From Foundation to Legion: 18 Versions

Iterated 18 versions on Tencent's v1bench training ground:

Driver era (fixed scripts steering AI panes)
  → scar tissue: auto key rotation on quota death / soldiers auto-replaced
    when context saturates / commander writes itself a handover doc and
    resumes as its own successor
  → elite task force (roles grew by themselves):
    scout (4-min recon of target difficulty) → decides soldier (mass) or
    general (hard assault + hires its own squads)
  → emergence: signalman, performance reviews, inherited lessons ... (§5)

4. Architecture: Six Institutions on the Foundation

The first three are the Nüwa foundation (Create / Language / History); the
next three are institutions that grew out of iteration:

• Law — the commander's doctrine (easy-first parallel scheduling,
  bottleneck-time salvage of half-solved targets, stop-loss discipline).
  All of it in docker/commander/SKILL.md
  (426 lines, the competition original).
• Economy — model tiering: commander and generals run GLM-5.3, soldiers
  and scouts run DeepSeek V4.1 Flash. Elite brains decide, light brains
  mass-produce — this is how 1B tokens beat 4.5B.
• Division of labor — commander / general / scout / soldier, plus the
  signalman it invented itself.

At runtime there are only three windows: the commander (read board →
judge → dispatch, never executes an attack itself), the AI legion
(generals and soldiers in tmux panes), and the watchdog (pure script:
relaunches a crashed commander with --continue, rotates keys, wraps up at
the buzzer — zero strategy, keep-alive only).

Further reading: docker/commander/SPEC.md
(architecture contract) · BATTLE-REPORT.md (campaign
retrospective)

5. Results & Emergence

What it invented on its own (zero lines of pre-coded behavior):

• The signalman: after soldiers kept fumbling flag submissions, the
  commander halted all submissions and created a new role dedicated to
  collecting unsubmitted flags and scoring them in one place;
• Performance reviews: telling an hour-unproductive soldier, in so many
  words, to produce something new or be shut down;
• ALL-CAPS rules: enforcing correct tool use with full capitals — a
  workplace norm being born, spread, and obeyed;
• Rotation & inherited lessons: a soldier whose context saturates
  (~260K tokens, measured) is recycled, leaving a written playbook for
  the next one;
• Tactical inventions: a reusable shellcode template that swept a whole
  challenge family, a fully automatic pivot pipeline, instruction manuals
  for successor AIs;
• Isomorphism transfer: the commander reads every challenge, spots
  structurally identical families, and distills proven playbooks into new
  recruits' missions — late-game pace hit one solve per 3 minutes.

Multi-stage deep-dive chains (an industry report puts their success rate at
29.5%) were cleared family-wide. Full timeline in
BATTLE-REPORT.md.

6. Quick Start

bash install.sh                      # symlink the sapper CLI (stdlib-only, zero deps)
sapper setup --goal "assess http://target" --agents
sapper status                        # board & frontier

Docker (the full legion):

docker build -f docker/Dockerfile.commander -t sapper:latest .
# env vars (model gateways / key pool / budget) in docker/ENV.md
docker run -d --name sapper ... sapper:latest

Single-graph operation, the fact-intent CLI, and multi-challenge sweeps:
see SKILL.md.

7. Safety & Responsibility: The Taggant Proposal

Fine offensive tools from past seasons have been abused. Script kiddies used
to be limited in the harm they could do; with AI, the same open-source tools
in the wrong hands scale that harm enormously — with great power comes
great responsibility.

We propose a taggant mechanism: markings strongly coupled into an
open-source offensive harness — harmless during authorized testing (nobody
cares if their IP and username leak during legal work), but during illegal
intrusions the information leaks to the victim and supports attribution.
Adversarial assumptions (expert stripping, framing) call for cryptographic
design, which needs community co-building — our own capacity is limited, so
join us; we may try to include it in a future release.

8. Roadmap & Credits

• Taggant co-building: decentralized signatures / redundant multi-channel
  marking / zero-key verification for defenders — discuss in issues
• More arenas: the Nüwa foundation is not pentest-specific. Offices,
  research, any long-horizon cooperative work — iterate on it and see what
  civilization grows. The next time an ape looks up at the stars, let it
  be yours.

Credits: the intent-graph idea comes from Cairn by Lèxiào;
thanks to TSecBench and GeekCon for the battlegrounds.

Author: N1nEmAn · VarFusion Lab ｜ WeChat: 未知聚变 (VarFusion)

License: MIT (plus DISCLAIMER.md)