Nightcrawler runs a full autonomous pentest agent on a phone with a 1.2B local model and no network
Surfaced on Hacker News August 3, Nightcrawler (MIT license, 152 stars) is an autonomous penetration testing agent that discovers hosts, maps services, tests for known vulnerabilities and default credentials, and generates a report entirely offline. It runs on Android with Kali NetHunter — tested on a OnePlus 8, requiring Magisk root and 12GB RAM — executing LFM2.5-1.2B-Instruct-Heretic locally on the phone GPU via llama.cpp and OpenCL, with SQLite for host/vuln storage and a Flask dashboard on port 8888. The notable claim is behavioral rather than technical: it paces actions slowly across multiple targets to mimic a human pentester rather than a scanner. Early and single-source, but it marks a real threshold — offensive agent tooling that needs neither cloud inference nor an internet connection.
↳ Follow the thread