THIS IS F**KING DANGEROUS. SOMEONE JUST UNLEASHED AN OPEN SOURCE AI HACKING ARMY TOOL THAT CAN LAUNCH AUTONOMOUS PENTESTING OPERATIONS. It’s called SAPPER. One AI commander. An entire swarm of AI agents. Real hacking tools running behind the scenes. Here’s what makes it stand out: → One AI commander... plans and coordinates the operation → Multiple AI agents work together to execute tasks → Runs real tools like Nmap and Nuclei → Built in hacking knowledge base for the agents → Integrates with Claude Code and Codex → Runs inside a Kali Linux environment It reportedly competed against 634 teams in a Tencent attack and defense competition and operated for 8 hours without human intervention. Fully open source. one commander —> multiple ai hackers—> an entire automated red team Only use it in authorized labs and CTF environments. REPO BELOWshow more

Repo : Follow @MAXdeg0 for more tool like this

autonomous red teams running nmap and nuclei via agent swarms is both insane and terrifying

for real. giving AI agents that much autonomy changes the game.

max with another dangerous tools on wednesday morning

haha, you know I’ve got more good finds coming, bro

bookmarked this alpha

good call, bro hope it comes in handy!

Thanks bro 👍

Join up More for cybersecurity tutorials and updates

great share max

thanks bro, always happy to share useful resources

SAPPER is really dangerous bro, top tier share as always max

thanks Roan always got more useful stuff to share 😁

With Nmap and Nuclei behind an agent swarm, the scope list is the real safety control. Does SAPPER refuse targets outside an allowlist, or is "authorized labs only" just a line in the README?

The idea of one commander + multiple agents running real tools is interesting. The risk is it becomes another tool that works in demos but falls apart on real targets. Have you seen actual results?

running nmap and nuclei was never the hard part of a pentest, it's deciding which finding is real and still inside the scope you signed

since it's fvkn dangerous max curious to know if it's safe to share with frens?

yeah, it’s safe to share as a learning resource. just make sure they practise in the provided labs

every week someone unleashes an ai army in caps lock

autonomous pentest swarms will change bug bounty economics fast. the real question is guardrails, who is accountable when an agent wanders out of scope.

one commander running a whole swarm of real tools with zero human babysitting for hours is the kind of thing that makes security folks both excited and slightly terrified

Impressive tool

Insane that it’s open source, a whole automated red team for free

Sapper 🫪🫪🫪

Need to give this a try, sounds quite useful in labs.

We'll take it

I’d worry about what those SI agents are allowed to touch. Target limits and approval for disruptive actions need to be enforced outside the model; a prompt isn’t a security boundary.

got the urge to throw it into a jailbroken Fable 5.1 and mess around.

Can this hack the FRITZ!box from my neighbors? I don’t wanna pay for WiFi at my new place. (Just kidding of course)

this was coming either way. more worried about people pointing it at stuff they don't own

👀

❌🙏

We built Hermes Shield for exactly this. Agent-to-agent security is about to matter a lot.

"It reportedly competed against 634 teams in a Tencent attack and defense competition and operated for 8 hours without human intervention." How successful was it?

Top find, plugging into Claude Code and Codex makes it easy to try tonight

@grok What have you heard about the effectiveness of the repo in regards to OP's claims?

Damnnnn this is gold

Great alpha bro tnx

The commander-plus-workers split is the part worth copying, even outside security. One planner, narrow workers, and a log of every command they run. For a tool like this, I'd add a hard allowlist of target hosts at the tool layer, so a confused agent can't wander off scope.