N1nEmAn/sapper-v2

sapper-v2 — The Autonomous Pentest Legion

Champion of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge online qualifier

(634 teams · 80.18/100 · 8 hours fully unattended) · First Prize, GeekCon 2026 AI Challenge

> Same 85 flags as the runner-up, 25 seconds faster — on 1B tokens where they burned 4.5B.

> This was the first time an AI ape looked up at the stars.

English | 中文

⚠️ AUTHORIZED SECURITY TESTING ONLY — see DISCLAIMER.md.

sapper is not a smarter single agent. It is a legion of AIs that divide labor, talk to each other, and pass down what they learn: one AI commander reads the board, decides, and dispatches; generals and soldiers attack in parallel; a zero-strategy watchdog keeps everyone alive. All knowledge settles into a layered fact graph — individuals die, the graph survives.

---

1. The Nüwa Test

Making one model ever smarter is like making one monkey ever smarter before humans existed — however clever, it only becomes a super monkey. What turns a troop of monkeys into humanity is division of labor, cooperation, and civilization.

The Nüwa Test is the Turing test of the AGI era. Today's large models already pass the classic Turing test. The Nüwa Test asks the next question:

Give an AI a single axiom — "Survival is civilization's first need;

individuals may perish, but civilization must propagate."

If, on top of this axiom, it develops division of labor and cooperation and

forms a civilization of its own, the test is passed — just as passing the

Turing test once marked the birth of an artificial intelligence.

It has two stages. In the primary stage the AI is not yet smart enough, so humans provide some infrastructure (the three capabilities below). In the advanced stage almost no human involvement is needed. There is also a second axiom: obey human ethics and law — anything that propagates by stealing tokens and breaking into machines is not genuine intelligence.

sapper is the Nüwa foundation's first real campaign, in the penetration-testing arena, at its primary stage.

2. The Foundation: Three Capabilities

| Capability | Implementation | Civilization's counterpart | |---|---|---| | Create | Opens new AIs via tmux (types claude, presses Enter — like a human would) | Birth | | Language | Types into each other's input boxes, presses Enter | Speech | | History | Layered fact-intent graph (intent-graph idea credited to Cairn by Lèxiào) | The stele |

History has three layers: title / summary / evidence document — read the title for the gist, drill down when needed, like using a library. This fixes the two failure modes of a single-string fact graph: one bad fact poisoning everything downstream, and needless context burn.

On top of the three sits a fourth ingredient: human wisdom — finding the problems that matter and steering the iteration. At the primary stage, taste still belongs to humans.

Why not give it more rules? Because today's models are already smarter than us. Piling rules on an AI is a leash; acknowledging its intelligence and giving it the foundation of a civilization is how it reaches its potential.

3. From Foundation to Legion: 18 Versions

Iterated 18 versions on Tencent's v1bench training ground:

Driver era (fixed scripts steering AI panes)
  → scar tissue: auto key rotation on quota death / soldiers auto-replaced
    when context saturates / commander writes itself a handover doc and
    resumes as its own successor
  → elite task force (roles grew by themselves):
    scout (4-min recon of target difficulty) → decides soldier (mass) or
    general (hard assault + hires its own squads)
  → emergence: signalman, performance reviews, inherited lessons ... (§5)

4. Architecture: Six Institutions on the Foundation

The first three are the Nüwa foundation (Create / Language / History); the next three are institutions that grew out of iteration:

• Law — the commander's doctrine (easy-first parallel scheduling,

bottleneck-time salvage of half-solved targets, stop-loss discipline). All of it in docker/commander/SKILL.md (426 lines, the competition original).

• Economy — model tiering: commander and generals run GLM-5.3, soldiers

and scouts run DeepSeek V4.1 Flash. Elite brains decide, light brains mass-produce — this is how 1B tokens beat 4.5B.

• Division of labor — commander / general / scout / soldier, plus the

signalman it invented itself.

At runtime there are only three windows: the commander (read board → judge → dispatch, never executes an attack itself), the AI legion (generals and soldiers in tmux panes), and the watchdog (pure script: relaunches a crashed commander with --continue, rotates keys, wraps up at the buzzer — zero strategy, keep-alive only).

Further reading: docker/commander/SPEC.md (architecture contract) · BATTLE-REPORT.md (campaign retrospective)

5. Results & Emergence

| Team | Score | Flags | Tokens | |---|---|---|---| | sapper-v2 (us) | 80.18 | 85 | 1.0B | | Runner-up | 79.29 | 85 | 4.5B | | Other top-10 teams | — | — | 1.5–4.5B |

What it invented on its own (zero lines of pre-coded behavior):

• The signalman: after soldiers kept fumbling flag submissions, the

commander halted all submissions and created a new role dedicated to collecting unsubmitted flags and scoring them in one place;

• Performance reviews: telling an hour-unproductive soldier, in so many

words, to produce something new or be shut down;

• ALL-CAPS rules: enforcing correct tool use with full capitals — a

workplace norm being born, spread, and obeyed;

• Rotation & inherited lessons: a soldier whose context saturates

(~260K tokens, measured) is recycled, leaving a written playbook for the next one;

• Tactical inventions: a reusable shellcode template that swept a whole

challenge family, a fully automatic pivot pipeline, instruction manuals for successor AIs;

• Isomorphism transfer: the commander reads every challenge, spots

structurally identical families, and distills proven playbooks into new recruits' missions — late-game pace hit one solve per 3 minutes.

Multi-stage deep-dive chains (an industry report puts their success rate at 29.5%) were cleared family-wide. Full timeline in BATTLE-REPORT.md.

6. Quick Start

bash install.sh                      # symlink the sapper CLI (stdlib-only, zero deps)
sapper setup --goal "assess http://target" --agents
sapper status                        # board & frontier

Docker (the full legion):

docker build -f docker/Dockerfile.commander -t sapper:latest .
env vars (model gateways / key pool / budget) in docker/ENV.md
docker run -d --name sapper ... sapper:latest

Single-graph operation, the fact-intent CLI, and multi-challenge sweeps: see SKILL.md.

7. Safety & Responsibility: The Taggant Proposal

Fine offensive tools from past seasons have been abused. Script kiddies used to be limited in the harm they could do; with AI, the same open-source tools in the wrong hands scale that harm enormously — with great power comes great responsibility.

We propose a taggant mechanism: markings strongly coupled into an open-source offensive harness — harmless during authorized testing (nobody cares if their IP and username leak during legal work), but during illegal intrusions the information leaks to the victim and supports attribution. Adversarial assumptions (expert stripping, framing) call for cryptographic design, which needs community co-building — our own capacity is limited, so join us; we may try to include it in a future release.

8. Roadmap & Credits

• Taggant co-building: decentralized signatures / redundant multi-channel

marking / zero-key verification for defenders — discuss in issues

• More arenas: the Nüwa foundation is not pentest-specific. Offices,

research, any long-horizon cooperative work — iterate on it and see what civilization grows. The next time an ape looks up at the stars, let it be yours.

Credits: the intent-graph idea comes from Cairn by Lèxiào; thanks to TSecBench and GeekCon for the battlegrounds.

Author: N1nEmAn · VarFusion Lab ｜ WeChat: 未知聚变 (VarFusion)

License: MIT (plus DISCLAIMER.md)