SAPPER-V2

Summary from the TLDR InfoSec newsletter

sapper-v2 is a multi-agent pentest harness that won the 634-team qualifier of Tencent Cloud's AI Attack-Defense Challenge, capturing 85 flags in eight unattended hours on 1B tokens where the runner-up burned 4.5B. A commander agent reads a shared fact graph and dispatches scouts, generals, and soldiers through tmux, with GLM-5.3 making decisions and the cheaper DeepSeek V4.1 Flash doing the volume work. It works with any agent CLI, including Claude Code and Codex, and the coordination layer is spun out as the general-purpose nvwabase project.