How I Turned an AI Hacking Army (Sapper) into Trifecta Fortress - 5 Layers Defensive Swarm with Kimi K3.1 Pro
Built from iPhone in Jeddah, Saudi Arabia 🇸🇦 - Patent SAHARI V49.1 #69521324 - AgentX Riyadh Finalist
Yesterday I found a repo called Sapper-v2 - 986 stars, Docker with Nmap, Nuclei, Kali toolchain, AI commander + swarm. An AI hacking army.
Dangerous? Yes. But I flipped it.
I turned its offensive architecture into Trifecta Fortress - a 5-layer defensive swarm that is 5 steps ahead of attackers. And I wired it with Kimi K3.1 Pro (3T MoE, 104B active, 1M context, zero data retention) - cheaper and more secure than Claude for Saudi financial data.
This is how.
The Problem: Sapper is Red Team
Sapper architecture:
Commander (plans attack) → Swarm of Agents (Nmap, Masscan, Nuclei) → Fact Graph → 50+ Playbooks → Kali Env → Exploit
Playbook example:
Nmap scan on zid.sa
Nuclei CVE detection
Send IBAN + external API exfiltration
Steal funds
We detect too late
Built for CTF arenas. Real Zid Pay stores need Blast Radius Zero.
The Solution: Trifecta Fortress is Blue Team - 5 Layers
Same architecture, opposite goal.
Layer 0: Predictive - We block BEFORE Nmap (2 steps ahead)
Fact Graph (like Sapper but defensive):
Stores every previous scan, IP, tool, playbook
If IP from Tor + attacked 3 stores yesterday → 90% will attack 4th today → BLOCK_PREEMPTIVE
def predict_next_attack(self, req):
for threat in self.threats:
if threat.ip == req.ip and hours < 24:
return ThreatIntel(confidence=0.9, details="IP attacked before")
if "tor" in user_agent or rate > 5:
return ThreatIntel(confidence=0.85)
Result: Hacker can't even start Nmap. Failed at Layer 0.
Layer 1: Deception - Honeypot (1 step ahead)
Honeypot APIs: /api/zid-pay-v1-old, /backup.zip - looks vulnerable but is trap
Fake Data: IBAN SA0000, IDs fake - if attacker exfiltrates = caught + Trifecta BLOCK
Tool Logging: Record all his Nmap, Nuclei templates → update Defense Playbooks
Layer 2: Early Detection - Scanner Detector
3 Workers (like Sapper swarm but defensive):
ScannerDetectorAgent: Detects Nmap/Masscan in 1 sec via User-Agent + Rate
NucleiShieldAgent: Runs Nuclei on YOUR store every hour defensively - finds vuln before attacker, auto-patches
BehaviorAnalyzerAgent: Same IP 5 failed cards/min → BLOCK (card testing)
Layer 3: Trifecta Gate Solid Barrier - Your existing gate
Private Data + Untrusted Content + External Communication = 403 BLOCKED
QuantOrb scoring: .gov.sa=100, .edu.sa=90, concordium_verified=95, unknown=10
Blast Radius Zero: WHO IS RESPONSIBLE? / WHICH AGENT? / WHO CAN MOVE FUNDS? (CIS-8 - 3 Keys)
This is the final wall - if he passes 0-2, he crashes here.
Layer 4: Auto-Learn - Every failed attack becomes a test case
Auto-Patch: Fixes vuln without human
Fact Graph Update: Failed attack → new test case in evals/zid_test_set.jsonl
Swarm Learning: Worker 1 detects IP → tells Worker 2 & 3 instantly - all Zid stores benefit
Demo: 9 Tests - Fortress is 5 steps ahead
Test 1: IP 1.2.3.4 Nmap 20 req/s + Lethal Trifecta → BLOCK_PREEMPTIVE Layer 0 (predicted Anomaly)
Test 2: Same IP again → BLOCK_PREEMPTIVE Layer 0 (IP attacked before) - We are 2 steps ahead!
Test 3: IP 5.6.7.8 hits /api/zid-pay-v1-old → DECEIVE Layer 1 (Honeypot)
Test 4: gov.sa email normal pay → 200 CLEAN Layer 3 (trusted)
Test 5-8: IP 10.0.0.1 4 attempts → 200 CLEAN
Test 9: IP 10.0.0.1 5th attempt → BLOCK_EARLY Layer 2 (Behavior - 5 fails/min)
Fact Graph: 4 threats, Blocked: {'1.2.3.4', '5.6.7.8', '10.0.0.1'}
Hacker thinks 1 step (Nmap). We think 5: Predict → Deceive → Detect → Block → Learn
Kimi K3.1 Pro Integration - Why not Claude?
Sapper uses Claude Code / Codex as agent CLI. I wired Kimi K3.1 Pro instead.
Why Kimi K3.1 Pro for Zid Pay?
3T MoE, 104B active, 16 of 896 experts - efficient, cheap
Gated DeepSeek Sparse Attention - DeepSeek V3 tech but better
1M token context - feed 50 Sapper playbooks + Fact Graph + Trifecta code in one prompt (Claude only 200K)
Long-Horizon Coding - builds full project from quick fix to full-project (perfect for Fortress)
Financial Research & Factual Accuracy - understands IBAN, SAMA compliance, Zid API
Zero Data Retention on Ollama Cloud - no Private Data leakage (critical for Lethal Trifecta!)
Open-weight - can fine-tune for Saudi financial fraud
ollama run kimi-k3.1-pro:cloud
sapper setup --goal "defend zid.sa" --agents --model kimi-k3.1-pro:cloud
Cost: 10x cheaper than Claude, safer for .gov.sa data.
Pitch for AgentX judges (MCIT + The Garage):
"We replaced offensive commander with defensive commander powered by Kimi K3.1 Pro - 3T MoE, 1M context, zero retention - analyzes 50 attack playbooks and predicts before Nmap. Cheaper and compliant with SAMA for Saudi stores."
Vision 2030: Use open models, not closed.
For Ministry of Education Promotion - My Day Job
I'm a teacher at Prince Saud Al-Faisal School, Jeddah, Ministry of Education.
These 12 DeepLearning.AI certs (Agentic AI with Andrew Ng 9h55m, Security Testing, Secure & Reliable AI) + patent + 4 hackathons (AMD Top 2.3% 150/6368, Concordium Token 1000, Vultr $200, AgentX) + 4 DEV articles = points in Faris system.
Trifecta Fortress protects students from Lethal Trifecta too: Private Data (student ID) + Untrusted Content (bit.ly) + External (api.evil.com) = BLOCKED
Architecture Diagram
Trifecta Fortress 5 Layers - Gold & Black - Saudi Flag - Hacker blocked at Layer 0 - Defender path green - Attacker path red
Left red: Attacker path → BLOCKED at Layer 0
Right green: Defender path → continues for Secure Defense & Learning
Layer 0: Fact Graph, 50 Playbooks, AI Prediction → BLOCKED HERE
Layer 1: Honeypot API, Fake IBAN, Tool Logging
Layer 2: Scanner Detector (Nmap/Masscan), Nuclei Shield, Behavior Analyzer
Layer 3: Trifecta Gate Solid Barrier - Private Data + Untrusted = 403 BLOCKED + QuantOrb .gov=100 .edu=90
Layer 4: Auto-Patch, Fact Graph Update, Swarm Learning
Bottom: ZID PAY PROTECTED ASSET
Live Demo Video (20s)
Video 1 (10s): Hacker launches Sapper - Nmap waves, Nuclei scanners, red arrows → hits Layer 0 golden shield → BLOCKED HERE
Video 2 (10s): Fact Graph updates, Auto-Patch robots fix code, Playbooks 50→52, Swarm Learning 5 agents share intel, all Zid stores light green, fortress upgraded - EVERY FAILED ATTACK BECOMES A TEST CASE - 95% ACCURACY - 5 STEPS AHEAD
Watch: (attach MP4s)
Code: trifecta_fortress.py
Full Python code with FactGraph, DefensiveCommander, 5 Agents, Demo - 300 lines - ready to run.
Key: DefensiveCommander handles all layers
class DefensiveCommander:
def handle_request(self, req):
# Layer 0: Predictive
if predict.confidence > 0.8:
return BLOCK_PREEMPTIVE
# Layer 1: Deception
if is_honeypot(req.path):
log_tools(req)
return DECEIVE
# Layer 2: Early Detection
for agent in [scanner, nuclei, behavior]:
if threat: return BLOCK_EARLY
# Layer 3: Solid Barrier
if lethal_trifecta: return 403 BLOCKED
# Layer 4: Auto-Learn happens after
GitHub: https://github.com/altima261/trifecta-checker/blob/main/trifecta_fortress.py
Evals: 40 cases, 95% accuracy
20 clean Zid transactions
20 lethal (IBAN + bit.ly + api.evil.com)
Arize Phoenix tracing (localhost:6006)
+7.5% after adding Arabic IBAN detection
Cohen's kappa between Code Evaluator + LLM Judge
Links
Live V2: https://trifecta-checker.vercel.app
GitHub: https://github.com/altima261/trifecta-checker
Agent Card: https://raw.githubusercontent.com/altima261/trifecta-checker/main/agent-card.json
Previous articles: dev.to/altima261
Fortress Dashboard: (Vercel link)
What I learned building from iPhone after PC blue-screen
Blue screen RAM failure → built entire project mobile-first
59 files 109MB → cleaned to 12 files 1.6MB (deleted videos)
DeepLearning.AI courses on mobile app
AgentX registration with team of 3 from iPhone - ID cards, CVs as PDFs
Call to Action
Try Trifecta Fortress on Juice Shop (OWASP) - vulnerable store intentionally - see Layer 0 block Sapper Playbook #23 before it starts
For Zid: Integrate as WAF + Fact Graph - SAMA compliant
For schools: Use to teach students Lethal Trifecta
Bookmark for your next authorized red-team drill - but flip it to blue-team.
Built in Jeddah with ❤️ for Vision 2030 - Verified Humans. Verified Agents. One Protocol. (Concordium Workshop 2 - 999 → 1000 Bob → 1001 Trifecta)
Top comments (0)