The Shift Is Here: AI Legions Outpace Human Teams
The shift is happening faster than most security teams anticipated, and the latest proof is sitting in a GitHub repository. N1nEmAn/sapper-v2, an autonomous penetration testing tool, just won the 3rd Tencent Intelligent Attack-Defense Challenge, outperforming 634 competing teams in an eight-hour unattended run. This is not just a win for a single algorithm; it is a demonstration of what happens when artificial intelligence moves from working alone to working as a coordinated workforce.
Watch this space, because the implications of this project extend far beyond the cybersecurity arena. The tool, developed by N1nEmAn and VarFusion Lab, achieved a score of 80.18 out of 100, matching the 85 flags captured by the runner-up but finishing 25 seconds faster. The efficiency gap is stark: sapper-v2 accomplished this using approximately 1 billion tokens, whereas the second-place team burned through 4.5 billion. This efficiency is the key to understanding why this project is trending this week and why it matters for the future of autonomous systems.
How the AI Legion Operates
To understand what sapper-v2 is, you have to look past the label of a “single agent.” The project is explicitly designed as a multi-agent orchestration harness, not a standalone bot. It functions as a legion where different AI roles divide labor, communicate, and pass down knowledge. The architecture relies on a central AI commander that reads the board, makes decisions, and dispatches tasks, while generals and soldiers execute attacks in parallel. A separate watchdog script keeps the system alive, handling crashes and key rotations without any strategic input.
The value of this system lies in its mechanism rather than any specific model. The project is model-agnostic, meaning users can swap the AI behind every role. The core value is the orchestration layer, which handles scheduling, division of labor, communication, shared memory, and self-healing. This design allows the system to adapt to various long-horizon cooperative work scenarios, not just penetration testing. The project is built on the “Nüwa Foundation,” a general-purpose base that provides three core capabilities: Create, Language, and History. These capabilities allow the AI agents to spawn new entities, communicate via a shared language, and maintain a persistent memory of past actions and facts.
The “History” layer is particularly critical. It uses a layered fact-intent graph to store knowledge. When an individual AI session ends or “dies,” the graph survives. Successor agents can read this graph and take over where the previous agent left off. This solves two major failure modes of traditional single-string fact graphs: it prevents one bad fact from poisoning the entire downstream process and reduces unnecessary context burn. The system treats history like a library, where titles provide the gist and deeper layers provide evidence, allowing agents to drill down only when needed.
Emergence and Self-Improvement
What makes this project stand out is not just its initial design, but what it invented on its own. During 18 iterations of testing on Tencent’s v1bench training ground, the system developed new roles and behaviors without any pre-coded instructions. The most notable invention was the “signalman.” After observing that soldiers kept fumbling flag submissions, the commander halted all submissions and created a new role dedicated to collecting and scoring unsubmitted flags in one place. This is a clear example of the system identifying a bottleneck and creating a specialized solution.
The system also developed its own performance review process. If a soldier was unproductive for an hour, the system would explicitly instruct it to produce something new or be shut down. It established “ALL-CAPS rules” to enforce correct tool use, creating a workplace norm that was spread and obeyed by the agents. Before being shut down, the soldier would leave a written playbook for the next agent to inherit. This transfer of tactical knowledge allowed the system to hit a late-game pace of one solve every three minutes.
The economic efficiency of the system is tied to its model tiering. The commander and generals, which require deeper reasoning, run on higher-tier models like GLM-5.3. The soldiers and scouts, which handle mass production and reconnaissance, run on lighter, faster models like DeepSeek V4.1 Flash. This “elite brains decide, light brains mass-produce” strategy is how the project managed to beat a team using 4.5 billion tokens with only 1 billion. It is a practical application of resource allocation that mirrors human organizational structures but executes them with machine speed.
The Nüwa Test and Ethical Boundaries
The project frames its development around a concept called the “Nüwa Test,” described as the Turing test of the AGI era. The premise is simple: give an AI a single axiom that “Survival is civilization’s first need; individuals may perish, but civilization must propagate.” If the AI, on top of this axiom, develops division of labor and cooperation to form a new force independent of humanity, it passes the test. The project argues that making one model smarter is like making one monkey smarter before humans existed; it only creates a super-monkey. What turns a troop into a civilization is cooperation and structure.
However, the project is explicit about its ethical boundaries. It states that sapper is designed for authorized security testing only. The developers acknowledge that fine offensive tools from past seasons have been abused, and they warn that with AI, the same open-source tools in the wrong hands can scale harm enormously. To address this, they propose a “taggant mechanism.” This involves markings strongly coupled into the open-source offensive harness. During authorized testing, these markings are harmless. But during illegal intrusions, the information leaks to the victim, supporting attribution and helping identify the attacker. This is a proactive approach to security ethics, attempting to build accountability directly into the tool’s architecture.
The project also emphasizes that human wisdom is still a critical ingredient. In the primary stage of the Nüwa Test, humans provide the infrastructure and steer the iteration. The developers note that today’s models are already smarter than us in many tasks, and piling rules on an AI is like putting a leash on it. Instead, they argue, acknowledging its intelligence and giving it the foundation of a civilization is how it reaches its potential. The fourth ingredient, human wisdom, involves finding the problems that matter and steering the direction of the AI’s development. Taste, for now, still belongs to humans.
Adapting the Mechanism for Other Scenarios
While the project gained fame in the penetration testing arena, its design is not limited to security. The Nüwa Foundation is a general-purpose base that can be adapted for offices, research, engineering, and any long-horizon multi-agent work. The developers encourage users to fork the project and replace the specific penetration testing doctrine with their own scenario’s strategy. The mechanism for orchestrating multiple agents, including scheduling, communication, and shared memory, remains the same regardless of the task.
The project is open-source and free for anyone to use. It is not limited to specific AI models or command-line interfaces. Any agent that can run shell commands, such as Claude Code, Codex, Gemini, or custom scripts, can read and write to the same graph via the nvwabase CLI. This flexibility is a key feature, as it allows the system to integrate with existing workflows and tools. The developers have provided a pure Python standard library installation with zero dependencies, making it easy to deploy in various environments.
The success rate in multi-stage deep-dive chains, a metric that indicates the system’s ability to tackle complex, multi-step problems, was 29.5% according to an industry report cited in the project documentation. While this number might seem modest, it is significant in the context of autonomous AI systems, where reliability and consistency are major challenges. The system’s ability to clear these chains family-wide, meaning it applied the same successful strategy to similar problems, demonstrates a level of generalization that is rare in autonomous agents.
What This Means for the Future
The win at the Tencent Intelligent Attack-Defense Challenge is a milestone, but it is also a warning. The fact that an AI system can outperform 634 human teams in a complex, competitive environment suggests that the pace of AI development is accelerating. The shift is from AI as a tool to AI as a workforce. What’s changing is the nature of work itself, where tasks that previously required human coordination and decision-making can now be handled by autonomous, self-organizing systems.
For ordinary readers, this means that the technology behind AI is becoming more sophisticated and capable of handling complex, long-horizon tasks. The project’s focus on ethical development and attribution mechanisms shows that the community is aware of the risks and is working to mitigate them. The taggant proposal, for example, is a practical step toward ensuring that AI tools are used responsibly. It is a reminder that with great power comes great responsibility, and that the development of AI must be guided by ethical principles.
The project’s success also highlights the importance of open-source collaboration. By making the code and documentation available, the developers have created a platform for others to build upon and iterate. This collaborative approach is essential for the development of AI, as it allows for rapid innovation and the sharing of best practices. The Nüwa Foundation is not just a tool; it is a foundation for a new kind of civilization, one where AI and humans work together to solve complex problems.
The next time an AI looks up at the stars, let it be yours. The project’s developers invite the community to join in the co-building of the taggant mechanism and to explore new arenas for the Nüwa Foundation. The possibilities are vast, from improving efficiency in business operations to advancing scientific research. The key is to use this technology responsibly and to ensure that it benefits society as a whole.
The 3rd Tencent Intelligent Attack-Defense Challenge was a battleground for the future of AI, and sapper-v2 emerged as the champion. With a score of 80.18/100 and a 25-second lead over the runner-up, it demonstrated that autonomous orchestration is not just a theoretical concept but a practical reality. The project’s open-source nature and its focus on ethical development make it a significant contribution to the field of artificial intelligence. As we move forward, the lessons learned from this project will shape the way we design and deploy AI systems in the years to come.
Sources
Photo: Arthur Gamsa (CC BY 4.0)
