| ▲ | Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone(github.com) | ||||||||||||||||
| 27 points by NickySlicks 2 hours ago | 9 comments | |||||||||||||||||
| ▲ | voodooEntity 40 minutes ago | parent | next [-] | ||||||||||||||||
The following rant is not against the owner/project - but... What an irony. I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to "dual use" legal problems - but llm driven tools hit public space...... sorry for the rant.... | |||||||||||||||||
| |||||||||||||||||
| ▲ | kreidema an hour ago | parent | prev | next [-] | ||||||||||||||||
I completely forgot that AI can very much also attack networks/devices in the wild. Interesting project. | |||||||||||||||||
| ▲ | oquidave an hour ago | parent | prev | next [-] | ||||||||||||||||
Why phone? This cuts out a lot of phones. Why not on a computer? | |||||||||||||||||
| |||||||||||||||||
| ▲ | NickySlicks 2 hours ago | parent | prev [-] | ||||||||||||||||
I built Nightcrawler, an open-source autonomous penetration-testing agent that runs entirely on an Android phone. The project started with a question: how much of a real pentesting workflow could I run locally on relatively old mobile hardware, without relying on a cloud model or API? Nightcrawler runs a 1.2B-parameter model locally on the Adreno GPU of a OnePlus 8. The model chooses targets and tools, while a separate scope-enforcement proxy validates every command before execution. The system maintains per-host memory in SQLite, rotates between targets, matches detected versions against a local CVE database, executes multi-step playbooks, and generates a structured report. A few implementation details that may be interesting: Local inference runs at roughly 115 prompt tokens/sec and 13 generated tokens/sec. The small model only produces a usable command around 50% of the time, so much of the engineering is recovery logic, duplicate detection, persistent memory, and deterministic playbooks. Every command passes through a separate scope and safety layer rather than trusting the model to remain in scope. The project includes a dry-run mode, so the agent loop can be tested without executing real network commands or owning the phone hardware. I've had it running on my home network for the past 3 months uninterrupted | |||||||||||||||||
| |||||||||||||||||