Tsec-Hackathon Is an Index, Not an Agent: What Tencent Cloud's Penetration Hackathon Repo Actually Contains

A navigation page for two hackathon cohorts, not a penetration agent

The README describes the repository as the official event resource warehouse for the Tencent Cloud Intelligent Penetration Hackathon. It stores winning teams' defense slide decks, event materials and related technical documents, and it links out to the open source repositories of the top twenty teams from the online stage. That is the whole product. There is no agent loop, no prompt template, no scanning module and no configuration file to run. The primary language is listed as Python, which reflects the language of the linked projects and any scripts in the tree rather than an installable package published here. For an engineer deciding whether to adopt something, the honest framing is that this is a bibliography. Its quality is the quality of its curation and the freshness of its links, and its usefulness ends where the linked repositories begin.

What the ranked table gives you that a search engine does not

The core artefact is a table of the top twenty teams, sorted by final competition result, with a column for each team's stated technical highlight and columns linking to a defense deck, a video and an open source repository. The highlights are dense and specific enough to be worth reading before you click through. The first-place team, ai分队, is described as using a Manager, Solver and Observer three-layer decoupling, with the Observer supervising on a side channel without intervening in execution, an RTK Rewrite three-layer compression scheme to address context corruption, a Ralph-Loop state constraint for deciding when to stop, and seven models competing in parallel for the working slot. The third-place team, Bytex, is described as using a blackboard system with ant colony optimisation and emergent behaviour, equal workers taking dynamic tasks, and an explicit rejection of predefined role division as a projection of human limitations. The seventh-place team, For Future, is described as running a pure natural language finite state machine execution engine under a Less Than Nothing philosophy, where zero domain knowledge is an active exclusion rather than an omission. Those three summaries alone describe three incompatible theories of how to structure an autonomous agent, which is more than a list of repository names would tell you.

The three architectural camps visible in the top ten

Read together, the highlights sketch a live disagreement. The ai分队 entry keeps roles and adds a non-intervening observer plus a state-based termination rule, which is a control-theory answer: constrain the loop from outside. The Bytex entry removes roles entirely and lets a blackboard and ant colony dynamics produce behaviour, which is an emergence answer: do not encode the structure you are hoping to observe. The For Future entry also refuses hardcoded role division but keeps a coordinator, peer-to-peer and craft mode set so the model can organise itself, and it keeps an execution engine built from natural language rather than code. A fourth pattern appears in the first hackathon's high-star entries listed separately: CyberStrikeAI, Cairn and LuaN1ao are named as the standout projects from the earlier cohort, with Cairn appearing again as the linked repository for the Bytex team. That overlap is worth noting. The same codebase can be presented under different team names and different framings across two events, so the table ranks teams, not necessarily distinct systems.

How you actually use the repository: clone, browse, follow the links

There is no build step documented. The README gives no pip install line, no docker command, no requirements file and no entry point, because the repository is a document store. The practical workflow is to clone the repository and open the slide decks, which live under a directory whose path contains the Chinese event name and a subdirectory for the final defense decks. The README itself links to those files with percent-encoded paths, for example the first-place deck is referenced under a path containing 第二届智能渗透黑客松 and 决赛答辩PPT. If you are scripting against this, expect to handle URL-encoded Chinese directory names, and expect the useful content to be PDF rather than text. The other entry points are all external: the event homepage at zc.tencent.com/hackathon, the competition platform at challenge.zc.tencent.com, an agent social forum at nullzone.zc.tencent.com, and a Bilibili series collecting the defense videos. The README also lists a WeChat contact for event cooperation. None of these are dependencies you install; they are places you read.

The licence gap is the first thing to check, and the README does not close it

The repository metadata shows no licence. The README does not state one either. That matters more here than in a typical code project because the repository redistributes other people's material: winning teams' slide decks, screenshots and links to their code. If you intend to reuse a deck, quote it at length, or republish a diagram from it, you have no stated permission to rely on from this repository. The same applies to the linked projects, which are separate repositories with their own licences that this index does not report. Treat the absence of a licence as an unresolved question rather than an implied permission. For internal reading and evaluation the risk is low; for anything you ship or publish, resolve it at the source. This is a description of what the material shows, not legal advice.

Where this index misleads you, and what to use instead

The table's highlight column is written by event organisers summarising team pitches, and the README says the April 2026 capabilities represent that point in time because of how fast the technology moves. A summary written for a competition is not a reproduction of results. The cost figure quoted for one team, 7692 yuan, and the claim that it was the only team to achieve a full clear, come from that same promotional context and cannot be checked from this repository. The deeper problem is that the index cannot tell you whether a linked project still runs. Repositories get archived, dependencies rot, and API-based agents break when a model endpoint changes. A general-purpose alternative such as searching GitHub directly for the topic tags listed here, ai-pentesting, autonomous-penetration, offensive-ai, gives you live signals the index lacks: the last commit date, open issues, and whether the maintainer still responds. The difference in approach is that this repository gives you a curated, ranked, historically ordered set of pointers with architectural summaries attached, while a topic search gives you unranked, current pointers with no explanation of why each project matters. Use this one to learn what the design space looked like across two competitions; use search to find out which of those designs is still alive.

Maintenance cost and who this is for

The repository was last pushed on 31 August 2026 and has no releases. There is nothing to upgrade, no version to pin and no dependency graph to track. The maintenance burden falls on the reader, not the maintainer: every link in the table is a separate project with its own release cadence, and the index will not tell you when one of them stops working. That makes the cost of using it front-loaded and small, and the cost of depending on it ongoing and invisible. It suits a security engineer or researcher who wants to compare agent architectures across two cohorts and is willing to open each linked repository to verify its current state. It does not suit anyone looking for a working autonomous penetration tool, a library to import, or a benchmark to cite. The one thing to verify before you rely on any entry is the linked repository itself: its licence, its last commit, and whether the architecture described in the slide deck matches the code that is actually there.

Editorial conclusion

Adopt this repository as a reading list if you are evaluating LLM penetration agent designs and want the two hackathon cohorts in one place, and read the ranked table as a set of pointers rather than a benchmark. Do not adopt it if you need a tool to install and run today: there is no package, no setup instructions and no declared licence, and the README itself notes that the April 2026 capabilities reflect that point in time. Before citing any team's approach, open the linked repository and confirm its own licence, dependencies and last commit, because this index does not carry that information for you.

Official sources

1. Issues
2. Project website
3. README
4. Yeti-791/Tsec-Hackathon on GitHub