Nightcrawler Runs A Pentest Agent Offline On A Phone

Nightcrawler runs a full penetration-testing agent on a rooted Android phone, using a 1.2 billion-parameter model with no internet connection, per its GitHub repo.

For anyone building intrusion detection around outbound network traffic, a scanning tool that never phones home doesn't show up on the usual sensors.

The project runs on Kali NetHunter on a OnePlus 8, requiring Magisk root and 12GB of RAM. Inference happens on the phone's own GPU through llama.cpp and OpenCL, running a model called LFM2.5-1.2B-Instruct-Heretic. Results land in a local SQLite database, viewable through a Flask dashboard on port 8888.

It discovers hosts, maps services, checks for known vulnerabilities and default credentials, and writes up a report, all offline. It paces its actions across targets slowly. The goal is to look like a person poking around, not a scanner sweeping a range.

The repo doesn't say how the pacing logic decides its timing, or how the tool holds up against defenses built to catch it specifically.

Nightcrawler surfaced on Hacker News on August 3 and had already picked up 152 stars on GitHub. It's MIT-licensed and single-source for now, one project rather than a trend. But it sets a marker: offensive tooling that runs its model and stores its findings entirely on the device, nothing to catch on the wire.