--- title: "Sapper-v2: Open-Source AI Pentest Swarm, Claims Checked" url: https://playciso.com/blog/sapper-v2-open-source-ai-pentest-swarm updated: 2026-11-05 section: Blog publisher: PlayCISO --- # Sapper-v2: Open-Source AI Pentest Swarm, Claims Checked > Sapper-v2 is an open-source AI pentest swarm claiming a Tencent competition win. What the README confirms, what is unverified, and what defenders do. Source: https://playciso.com/blog/sapper-v2-open-source-ai-pentest-swarm · Published: 2026-11-05 · Publisher: PlayCISO (https://playciso.com) Primary source: https://github.com/N1nEmAn/sapper-v2 --- **Sapper** (the GitHub repository *N1nEmAn/sapper-v2*) is an MIT-licensed, open-source system in which one AI "commander" plans and dispatches a swarm of worker agents over a shared fact graph, built for CTF-style attack-defense competitions. Its README says it took first place in the online qualifier of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge, with **634 teams** and **8 hours** unattended. We read the repository on **5 November 2026** and confirmed what the tool is and what it says. The competition result is the author's claim: we could not find it on an organiser page, and the author's own battle report gives different numbers. **Who this is for:** CISOs, heads of security testing, red-team and AppSec leads, and anyone who lets coding agents run on company machines. *We opened the sapper-v2 repository page, README, disclaimer, battle report and release page, an earlier repository by the same author, the author's profile and the Tencent Cloud hackathon site on 5 November 2026. We did not run the tool. The social-media post that prompted this story was supplied to us and is treated as unverified. PlayCISO is not affiliated with any project or person named. This post gives no commands, setup steps or payloads.* Confirmed vs not yet known **Confirmed from the repository pages:** the project is MIT-licensed with a separate DISCLAIMER.md and an "AUTHORIZED SECURITY TESTING ONLY" notice. The README describes a commander that reads the board, decides and dispatches and "never executes an attack itself"; worker generals, soldiers and scouts running in terminal panes; a watchdog script that relaunches a crashed commander and rotates API keys; and a layered fact store. It offers a pre-built Docker image of about 1.2 GB described as "full Kali toolchain + sapper + offline KB". The agent behind each role is swappable, and the README names Claude Code, Codex, Code Buddy, DeepSeek and "any interactive CLI". The Releases page lists one release, `v18-champion`, titled "Online Qualifier Champion Build" and frozen at a commit dated 18 October 2026. **Claimed by the author, not independently verified:** champion of the online qualifier of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge; 634 teams; 8 hours fully unattended; a score of 80.18 out of 100 against a runner-up's 79.29; about 1 billion tokens against the runner-up's 4.5 billion; and a First Prize at the GeekCon 2026 AI Challenge. The battle report cites event logs, a score curve and consumption records that are not published. **The sources disagree:** the README gives 85 flags and a 634-team field, while the battle report (as we read it) describes first place among 50 teams with published scores, about 45 flags across 36 or more solved challenges and about 110 CNY of API spend, and gives no token counts. We could not reconcile the two. **Not confirmed:** the Tencent Cloud hackathon site lists 2025 and 2026 "intelligent penetration" editions and has no entry for a "3rd attack-defense challenge", "Throne Protocol" or a leaderboard. The social post's figure of 986 stars does not match what we saw: the repository page showed 1.3k, a wiki page 596 and a trending site about 410. The README text we read does not name Nmap, Nuclei or Masscan, and does not state a count of 50+ playbooks. Those details come from the post. **Not yet known:** whether the organisers will publish results, whether anyone has reproduced the run, how much of the outcome came from the tool and how much from the models and the competition's design, and whether anyone has misused it. We found no source saying so. ## What happened A researcher publishing as N1nEmAn released *sapper-v2*, which the repository describes as an "autonomous pentest legion". Its README presents a division of labour: a commander that does not attack itself, workers that do the tool work, and a shared store of findings so that a result found by one worker is available to the others. The author's profile describes a cybersecurity undergraduate and CTF player interested in connecting language models to tools. An earlier, smaller repository by the same author, [N1nEmAn/sapper](https://github.com/N1nEmAn/sapper), describes a fact-graph memory tool for pentest agents and is a different project from v2. At the time we looked, sapper-v2 showed 13 commits on its main branch, about 737 forks and three open issues. ## Timeline | Date | Event | Source | | --- | --- | --- | | 2025 and 2026 | Tencent Cloud hackathon site lists first (2025) and second (2026) "intelligent penetration" challenge editions; no third attack-defense edition is listed | Tencent Cloud hackathon site | | 18 October 2026 | Date of the commit at which the v18-champion build is frozen | sapper-v2 releases | | 2026 (month and day not stated) | README claims a first-place result in the online qualifier of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge (634 teams) and a GeekCon 2026 First Prize | sapper-v2 README | | 1 November 2026 (as shown, year not shown) | v18-champion release published, with a Docker image or source build and a checksum | sapper-v2 releases | | 5 November 2026 | We read the repository, disclaimer and battle report; stars shown as 1.3k | sapper-v2, BATTLE-REPORT.md | ## How to read the competition claim - It is the author's account. The README and battle report are written by the project's author. The organiser's site we opened does not list the event, and we found no news coverage of the result. - The numbers differ between pages. The README and the battle report give different field sizes and flag counts. Until the organisers publish results, treat the ranking as unconfirmed. - A competition is not a production network. Competition targets are assigned, isolated and scored. The README itself says isolated competition environments against official targets are the intended deployment. A strong result there says little about performance, or safety, elsewhere. - The cost claim matters more than the rank. The battle report says cheap models did most of the execution work and a stronger model planned, for a stated spend of about 110 CNY. If that is even roughly right, running many agents is inexpensive, which is the part defenders should plan around. - The project is open about its limits. The older repository warns that its prompt-injection defence is "a textual fence, not a sandbox". Agents that read hostile target output are themselves an attack surface. ## What defenders should expect Whatever the final ranking, the pattern is consistent with our [master guide](/blog/agentic-pentesting-systems-master-guide) and with the other frameworks we have covered: orchestrated agents that drive real scanners and chain tools without a human, with crash recovery and key rotation built in. Expect probing that is broader, more persistent and faster to adapt, from authorised testers and from anyone else. The difference you control is the deployment: authorised and logged, or not. For comparison, see [T3MP3ST](/blog/t3mp3st-open-source-ai-pentest-agent), [ARTEX](/blog/artex-agentic-offensive-frameworks-gtig), the [AntiFox fork](/blog/antifox-artex-fork-exposed-consoles) and [CAIRN](/blog/operation-cairn-autonomous-ai-attack-platform); for a legitimate local environment, see [Executioner](/blog/executioner-agentic-pentest-environment). ## What security leaders should do this week - Write down who may run agentic testing. Require written scope and authorisation, with a named owner, before an internal team points any agent swarm at a system. The [scoping checklist](/tools/penetration-test-scoping) covers human-or-agent testers. - Require a kill switch. Any internal agentic test needs a tested way to stop every worker at once and revoke its credentials, because these systems are designed to keep running unattended. - Lock down coding-agent machines. Restrict egress and the tokens, keys and cloud profiles a coding agent can read, since a swarm runs with whatever its host can reach. Practise in the [agent egress containment lab](/tools/agent-egress-containment-lab). - Protect model API keys. The design rotates several keys under rate limits, so a leaked key funds someone else's agents. Store keys in a secrets manager, scope and cap them, and alert on unusual usage. - Detect automated multi-tool probing. Tune web, network and identity monitoring for breadth, rate and sequence across tools rather than single signatures; expect scans that adapt as results come back. - Log AI-agent tool calls. Record commands, network calls and file access by agents on endpoints and servers so automated activity from an internal host is visible and attributable. - Review agent skills and plugins before running them. Skill files and agent add-ons execute with the agent's permissions and can carry hostile instructions; use the [agent plugin supply-chain lab](/tools/agent-plugin-supply-chain-lab) to set a review step. - Treat tool output as untrusted input. If your own team runs agents against real systems, assume target content can try to steer the agent, and isolate those runs. - Read benchmark and contest claims sceptically. Ask for the event page, the rules, the model, the cost and the data. The [agent benchmark explorer](/tools/agent-benchmark-explorer) helps. - Score the wider picture with the [Agentic Attack Readiness Scorecard](/tools/agentic-attack-readiness), and check hosts you own for exposed agent consoles with the [Open Agent Exposure Scanner](/tools/agent-exposure). ## Frequently asked questions ### What is Sapper (sapper-v2)? Sapper, published as the GitHub repository N1nEmAn/sapper-v2, is an MIT-licensed open-source system for autonomous penetration testing. Its README describes one AI "commander" that reads a shared board and dispatches a swarm of worker agents (generals, soldiers and scouts) running in terminal panes, with a layered fact graph and an offline knowledge base. It is built for CTF-style attack-defense competitions. ### Did Sapper really win a Tencent competition? The README says it was champion of the online qualifier of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge with 634 teams and 8 hours unattended. That is the author's claim. We found no organiser page listing the event or its results: the Tencent Cloud hackathon site we opened lists 2025 and 2026 "intelligent penetration" editions only. The author's own battle report gives a narrower picture (first among 50 teams with published scores), so the figures are not consistent with each other. ### How many stars does it have? It depends on where and when you look. The social post we were given said 986. The repository page showed 1.3k when we opened it on 5 November 2026, a wiki page showed 596 and a trending-repositories site about 410. Stars are a moving, easily inflated number and are not a measure of quality or safety. ### What tools does the Docker image contain? The README describes a pre-built image of about 1.2 GB as "full Kali toolchain + sapper + offline KB". The text we read does not list individual scanners. Claims that it ships specific scanners come from the social post, not from the README, so we do not repeat them as fact. ### Which agent CLIs does it work with? The README says the agent behind each role is swappable and names Claude Code, Codex, Code Buddy and DeepSeek, plus "any interactive CLI". It also names models used in the author's run (GLM-5.3, DeepSeek V4.1 Flash and Claude Sonnet). ### Is it safe or legal to use? The README is headed "AUTHORIZED SECURITY TESTING ONLY" and the disclaimer says you may deploy it only against systems you own or have explicit written permission to test. It also says the authors may assist lawful investigations into abuse and that future versions may carry traceable markings. Legality depends on your authorisation, not on the tool. We did not run it and cannot vouch for its safety. ### Is it an "AI hacking army"? That is promotional framing, not a finding. What the README documents is orchestration: a planner agent, worker agents and a shared store of findings, with a watchdog script that restarts a crashed commander. The security question is the same as for any capable open-source tool: who can run it, with what authorisation, and what the machine running it can reach. ### What should defenders change? Plan for faster, cheaper and more persistent automated probing that chains several tools without a human. Require written scope and authorisation for any internal agentic testing, keep a kill switch, restrict egress and credentials on machines that run coding agents, protect model API keys, log AI-agent tool calls, detect automated multi-tool probing, and review agent skills and plugins before running them. ### Is there evidence attackers use Sapper? We found none in the sources we read. That is an absence of evidence in a few sources, not proof it is unused. ## Sources *All opened 5 November 2026.* - [N1nEmAn/sapper-v2 repository and README (architecture, Docker image, agent CLIs, competition and prize claims, authorised-use notice)](https://github.com/N1nEmAn/sapper-v2) - [sapper-v2 releases (v18-champion, frozen at a commit dated 2026-10-18)](https://github.com/N1nEmAn/sapper-v2/releases) - [sapper-v2 DISCLAIMER.md (authorised use only; no warranty)](https://github.com/N1nEmAn/sapper-v2/blob/master/DISCLAIMER.md) - [sapper-v2 BATTLE-REPORT.md (the author's own account of the run; figures not independently audited)](https://github.com/N1nEmAn/sapper-v2/blob/master/BATTLE-REPORT.md) - [N1nEmAn/sapper (earlier, separate fact-graph tool by the same author)](https://github.com/N1nEmAn/sapper) - [Tencent Cloud hackathon site (lists 2025 and 2026 intelligent penetration editions; no third attack-defense edition, Throne Protocol or leaderboard found)](https://tch.cloud.tencent.com/) - Original social-media post: supplied to us, not independently verified; its 986-star figure and tool list were not matched by the README we read. - Searches for news coverage or organiser results found only the project's own pages and third-party repository listings; no independent confirmation of the ranking.