Nightcrawler is a local AI pentesting agent that runs on a smartphone, enabling security testing directly from mobile devices. It leverages AI to automate penetration testing tasks, making security assessments more accessible and portable.
SynthePulse Insight · AI deep readingMembers
Version 1 · 1 source
An open-source project called Nightcrawler claims to have achieved a fully localized AI penetration testing agent that runs on a smartphone with no cloud connection. Can it truly change the landscape of security testing?
Nightcrawler is an autonomous penetration testing agent designed to run entirely on a smartphone. According to the project README, it uses a local AI model (LFM2.5-1.2B-Instruct-Heretic, 1.2 billion parameters) for inference on the phone's GPU, requiring no internet connection or cloud API. The agent can autonomously discover hosts, map services, find vulnerabilities, and generate penetration testing reports.
Its workflow includes optional WiFi cracking (using an external USB adapter), reconnaissance, enumeration, exploitation, and report generation. The project emphasizes stealth: the agent rotates hosts and performs small actions each round, gradually building knowledge, making it harder to detect than traditional vulnerability scanners.
The project also includes 27 exploit playbooks and a CVE database of 24,956 entries, supporting version-aware vulnerability matching. Additionally, it offers a web dashboard for real-time monitoring and control, as well as passive discovery features that capture mDNS/NBNS/DHCP/ARP broadcasts.
This report is based on the Nightcrawler project's GitHub README (sourced from a Show HN post on Hacker News). All features, performance data, and security mechanisms are claimed by the project and have not been independently verified. The project is in its early stages, and its actual effectiveness and security require further testing.
Primary report
Primary source