Radar / AI security / sapper-v2
sapper-v2: autonomous pentest legion with an AI commander and worker swarm
sapper-v2 is an autonomous penetration-testing system: an AI commander directs a worker swarm over a layered fact-intent graph, claiming 3rd place in a Tencent intelligent attack-defense contest against 634 teams.
Why it matters
It treats pentesting as a multi-agent campaign rather than a single-agent scan, with a commander planning attack paths and workers executing them unattended for 8 hours.
What you could build with it
A security team could run sapper-v2's commander-and-worker swarm against a staging environment overnight, getting a layered attack-path report by morning instead of booking a red-team engagement weeks out.
Does it hold up?
Proven in one arena and nowhere else yet: it took 3rd place in a Tencent CTF qualifier running 8 hours unattended, but it is built for competition scenarios and authorized testing only, with no evidence yet of production security-team adoption.
Built with sapper-v2
- Developer open-sources 'sapper-v2' AI agent swarm, says it won Tencent pentest competitionminutesofai · News report on the release: 80.18/100 with 85 flags on 1.0B tokens versus the runner-up's 4.5B tokens in the Tencent Cloud Intelligent Attack-Defense Challenge qualifier.
- sapper-v2 — features and alternativestoolerific · Feature breakdown of the commander/worker-swarm orchestration, the fact-intent graph, and how the same mechanism can be re-skinned for non-pentest scenarios.
- Introducing Sapper-V2, an autonomous pentest legionyoutube · Short video explainer of the multi-agent orchestration harness: commander dispatch, parallel worker agents, and the shared fact-intent graph.
- N1nEmAn/nvwabasegithub · 39 ★ · The Nüwa Foundation spun out of sapper-v2: the general-purpose Create/Language/History base without the pentest doctrine, for building other multi-agent swarms.
Learn more
First spotted on github: source.
More AI security
NVIDIA SkillSpector: security scanner for AI agent skills, trending againNVIDIA's open-source SkillSpector scanner is trending on GitHub today: it audits AI agent skills before installation…security · JEV 0.75Cloudflare security-audit-skill: turn your coding agent into a security auditorA coding-agent skill for multi-phase security audits with independently verified, machine-readable findings.security · JEV 0.72Shannon: open-source AI pentester that reports only vulnerabilities it can actually exploitCLI agent that combines source-code analysis with live exploitation against web apps and APIs under a 'no exploit, no…security · JEV 0.71AiSOC: open-source AI security operations center with agent triageSelf-hosted SOC that fuses alerts into incidents and hands them to LLM agents that record every prompt and tool call…security · JEV 0.71iFixAi: independent auditing of AI agents in under 120 secondsiFixAi audits whether an AI agent is doing what it is supposed to do, run by a human or by the agent itself, answering…security · JEV 0.68Anthropic FlashProve: cryptographic proof of which AI model actually answeredAnthropic open-sourced FlashProve, a research prototype that uses zkSNARKs to prove a response came from one specific…security · JEV 0.53
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.