A championship scorecard brought in 1,400 stars: sapper-v2, a CTF player open-sourced the AI pentest 'legion' used in the competition as-is

In Oct 30, a PWN-focused CTF player open-sourced his multi-agent pentest framework on the day of a competition final. It had placed first in an online round. The image, prompts, and battle report were all included. Forks outpaced stars for the first two days. By day six, an English tweet saying 'AI hacker legion, this is dangerous' brought in 500 stars in a single day. Autonomous pentesting already has projects with tens of thousands of stars, and this one has no stronger features. What it does have is a scorecard that can be quoted as-is. Below: where its stars came from, which steps you can replicate, and which step you can't.

The champion's code goes up on GitHub on finals day

On the afternoon of Oct 2026, 30 3, the offline finals of the 3rd Tencent Cloud Intelligent Attack-Defense Challenge and TSecCon were being held in Shenzhen. A new repo appeared on GitHub: N1nEmAn/sapper-v2. The first line of the README reads: 'Champion of the online round of the Tencent Cloud Intelligent Attack-Defense Challenge, 634 squad, 80.18 points, 8 hours fully unattended.' Like the runner-up, it captured 85 flags, in 25 seconds, using only 1B tokens, while the rival burned 4.5B. The line below: 'This is the first time the AI apes have looked up at the stars.'

The author, Wanli Chen (on GitHub as N1nEmAn, known in the scene as 9man), is a PWN player on the HASHTEAM and NEPNEP teams. He has 51 public repos, and before this his top repo had 78 stars, none over a hundred. The v1 version of the same framework was open-sourced 10-16 and has 32 stars to date.

What's different about v2 is that it arrives with a scorecard, and the package is complete: a 1.2GB Docker image (with the full Kali toolchain and an offline knowledge base), the commander's 426-line 'military code' SKILL.md from the original competition, and a BATTLE-REPORT that breaks down 8 hours of 94 platform events and 44 scoring points one by one.

What it is

An 'orchestration layer,' not a smarter agent. The implementation is crude: tmux opens a new window, you type claude and press enter, and that 'births' an AI; typing into another's input box and pressing enter is 'talking.' Every confirmed fact is written to a fact graph with three layers (title / summary / evidence). If an AI session dies, the graph survives, and the successor reads it and continues. Pure Python standard library, zero dependencies. Claude Code, Codex, or any other command-line agent can be swapped in.

In operation there are only three roles: the commander only watches the board, judges, and assigns work, never touching the keyboard; generals and soldiers work in parallel on targets; and a watchdog script with no strategy at all restarts anything that crashes. Cost is controlled by model tiering: the commander and generals use GLM-5.3, soldiers and scouts use DeepSeek V4.1 Flash. That is where '1B tying 4.5B' comes from.

The most compelling passage in the README is 'the things it invented on its own.' Soldiers kept submitting flags out of order, so the commander halted all submissions and set up a dedicated 'signal officer' to collect and submit flags. A soldier producing nothing for an hour was told outright to 'bring something new or get shut down.' Rules were written in all caps to force correct tool use. And before a soldier with a full context window (measured at about 260k tokens) was recycled, it left a playbook for its successor.

Who it's competing with

There are many open-source projects doing 'AI goes and pentests on its own.' The leaders already have tens of thousands of stars (GitHub, 11-06):

Feature-wise, the 'commander + swarm + shared memory' concept is also found in T3MP3ST, Cairn, and ARTEX. What sapper-v2 has beyond the others is just one thing: a championship scorecard from a third-party competition, plus an emergence story that's easy to retell.

Where the stars came from: three phases

GitHub daily stars / forks:

By 11-06, the GitHub page already showed 1,443 stars and 821 forks.

Part 1: Participants come to grab the code (10-30 to 11-02). This year's qualifier had 634 teams. Across three editions, 1,500+ teams and 3,000 players have taken part (Kuaikeji). On Trendshift, on 10-30 the repo gained 0 stars and 94 forks, and 10-31 then added 209 more forks. Forks came before stars, which most likely means competing teams and China's CTF community were saving the champion's code to study and reuse for the next edition. The champion ARTEX from the Baidu contest showed the same pattern after it went open source, with more forks than stars. The author also published a long design piece on WeChat Official Accounts, and the README's first screen links to it, yet that reading volume is never visible. The fork-to-star ratio is now 0.57, while a typical project sits around 0.1.

Part 2: English-language news sites and GitHub-discovery accounts (10-31 to 11-03). agentcrunch.ai ran a piece (10-31). alphasignal.ai ran one titled "SAPPER-v2 Beats 634 Teams in Hacking Contest Using AI Agents Alone" (11-03). @RepoGems posted about it (11-01, 41 views). There are YouTube Shorts and Instagram videos introducing it, plus a pile of auto-aggregator sites. Reach is small, but stars have been growing by 60 to 160 a day.

Part 3: One post (11-04 → single-day +500+). On 11-04 at a little after 7 p.m. Beijing time, the X account @MAXdeg0, with 17k followers, posted. The first two lines were in all caps: "THIS IS F**KING DANGEROUS. SOMEONE JUST UNLEASHED AN OPEN SOURCE AI HACKING ARMY TOOL." Below that were the selling points: an AI commander, a swarm of AI agents, real tools like Nmap and Nuclei, integration with Claude Code and Codex, running inside Kali, and "reportedly beat 634 teams in Tencent's attack-defense contest with zero human intervention for 8 hours." The post reached 11-06 with 305k views, 2,925 likes, and 3,770 bookmarks (X, 11-06). Trendshift recorded 11-05 as +506 stars, and the GitHub daily figure for that cell was +11-06 / +528, which matches.

Channels that did not work are worth noting too: there was no Hacker News thread, nothing turned up on Reddit, and it never made the GitHub Trending or Trendshift top 25.

Why this one

• The timing landed on finals day. Event news (Kuaikeji, Zhihu) was coming out, and people in the community most wanted to know "how did the first-place team actually build it?"
• The scoreboard could be copied word for word. "Team 634 first place, 8 hours unattended, 1B tied with 4.5B." MAXdeg0, alphasignal, and agentcrunch all used these numbers unchanged. One caveat: the overall champion of the main track's offline finals was the alkaerr team from Sichuan University. sapper-v2 refers to the "online contest champion," and neither that ranking nor the README's "GeekCon 2026 AI Challenge first prize" has been verified through official channels. English reposts commonly wrote "beat Tencent's contest," and the vagueness actually helped spread it.
• Everything was included, so people could follow along. Images, the original rules, and the match reports were all there, which explains the high fork count.
• The story works as a headline. "The Nüwa test," "AI apes gazing at the stars," "the AI invented its own signalers and performance reviews": these naturally fit the "this is dangerous" style of reposting.
• It rode the Claude Code multi-agent orchestration wave. The repo's topics include claude-code. Some of the stars came from people who don't do penetration testing and just want to learn how multiple agents divide work without colliding. inwpu/SapperLens (76 stars) is dedicated to dissecting its prompts and scheduling.

If it were you

My read: the playbook is clear and copyable, but only if you actually have a scoreboard to show. Without that card, the same code would probably sit at 32 stars on v1.

Who it's for: individuals or teams who compete in CTFs, attack-defense contests, various agent competitions, or public benchmarks (such as Cybench) and can place near the top; developers who already have their own agent orchestration and want a venue to prove it.

Who it's not for: people hoping to collect stars with "yet another AI pentest framework." The top of this niche sits at 70k stars, and everyone's feature claims sound about the same. The author's own generic base, nvwabase, has only 28 stars, which shows that architecture alone without a result doesn't bring stars.

How to do it:

1. Find a contest or benchmark with a third-party leaderboard and get a placement first. The Tencent and Baidu champions both gained traction after going open source, and the same approach works for the next edition, agent contests from other companies, or public security benchmarks.
2. Open-source on the day of the awards or results release, and release everything at once: a runnable image, the contest's original prompts, and a detailed write-up of the match. Participants will fork it first.
3. The README's first screen should show only directly citable comparison numbers (placement, scores, time taken, token comparisons), followed by a story about "what the AI learned on its own."
4. Get the placement exactly right. sapper-v2's "online contest champion" got spread as "Tencent champion." That helped in the short term but carries the risk of being exposed in the long term.

How to acquire users: Publish first on WeChat Official Accounts and in contest circles (team groups, Xianzhi, Kanxue) to get the first wave of forks. On the English side, pitch AI news sites like alphasignal and agentcrunch and GitHub-discovery accounts, then aim for a single repost from a mid-sized X account focused on AI tools. For sapper-v2, that one post was the only real amplification.

When the window closes: The window follows the contest calendar, and open-sourcing within one to two weeks after the event is when the buzz is strongest. The "champion goes open source" playbook has already appeared twice in two months (ARTEX and sapper-v2). Later on, the novelty of "yet another champion framework" will fade for both news sites and readers.

Signs you misread it: If sapper-v2 stalls at one or two thousand stars by mid-to-late November with daily gains falling to dozens, the ceiling for this type of project is the wave a single post generates. If the next few open-sourced champion projects don't get comparable reposts, it means this card has already worn thin.