Nightcrawler v0.1.0: Autonomous Local AI Pentesting Agent for Smartphones

Nightcrawler v0.1.0 is an autonomous penetration testing agent designed to run entirely on a smartphone, enabling red teamers to deploy a "drop box" device that discovers hosts, maps services, and identifies vulnerabilities without requiring cloud connectivity or internet access. By combining a local LLM with a suite of security tools, it automates the reconnaissance and exploitation phases of a professional pentest while maintaining a stealthy profile.

Local AI Architecture and Performance

Nightcrawler utilizes a small-parameter AI model running on the device's GPU to make operational decisions. The current production configuration uses the LFM2.5-1.2B-Instruct-Heretic model, quantized to Q8_0, running via OpenCL on an Adreno 650 GPU (tested on a OnePlus 8).

Inference Benchmarks

Model	Quantization	Prompt Speed	Generation Speed
LFM2.5-1.2B-Instruct-Heretic	Q8_0	115 tok/s	13 tok/s
Qwen3.5-0.8B	Q8_0	30.5 tok/s	6.3 tok/s
Qwen3.5-4B	Q4_0	10.1 tok/s	2.0 tok/s

To combat Android's native GPU throttling on battery power, Nightcrawler implements a GPU governor daemon that forces maximum performance, automatically throttling back only when the battery drops to 15% or lower.

Autonomous Pentesting Workflow

The agent operates through a continuous loop of target selection, reasoning, and execution. It is designed to mimic a patient human pentester by rotating across hosts and performing single actions per turn to avoid detection by Intrusion Detection Systems (IDS).

The Operational Pipeline

1. WiFi Breach (Optional): If deployed without network access, the agent can autonomously crack WPA2 networks using an external USB WiFi adapter.
2. Reconnaissance: The agent performs stealthy scans to discover devices on the local network.
3. Enumeration: It probes discovered services such as SSH, DNS, and web servers.
4. Exploitation: The agent tests for known vulnerabilities and default credentials using a local database of 24,956 CVEs and 27 multi-step exploit playbooks.
5. Reporting: A structured report is generated containing all findings and remediation advice.

Agent Decision Logic

Because the 1.2B model has an approximate 50% command success rate, the system relies on extensive recovery engineering:

• Garbage Detection: A five-streak failure triggers a context reset with varied few-shot examples.
• Stuck Detection: A five-minute backstop forces a context reset to prevent infinite loops.
• Deterministic Playbooks: Complex multi-step attacks bypass the LLM entirely to ensure reliability.
• Duplicate Detection: The agent is forced to diversify tools and targets if it repeats actions.

System Design and Safety Layers

Nightcrawler separates the "brain" (LLM) from the "hands" (tool execution) to ensure safety and stability.

Scope Enforcement Proxy

Every command generated by the LLM must pass through a Scope Proxy. This safety layer validates the command against the defined mission scope (networks, excluded hosts, and excluded ports) and blocks destructive commands via a command filter before they reach the Kali MCP server.

Technical Stack

• OS: Android with Kali NetHunter (Root access via Magisk required).
• Hardware: OnePlus 8 (Snapdragon 865, 12GB+ RAM).
• Database: SQLite for persistent storage of hosts, vulnerabilities, and credentials.
• C2 Interface: A Flask-based web dashboard providing a live feed, network map, and C2 controls, which spoofs nginx headers to remain stealthy from the target network.

Community Insights and Considerations

Discussion surrounding the project highlights the tension between the utility of AI-driven security tools and the legal complexities of "dual-use" software.

"I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to 'dual use' legal problems - but llm driven tools hit public space."

Other technical concerns raised by users include the potential for "well-formed" but incorrect commands (e.g., targeting the wrong host) to bypass the scope check, as the scope proxy validates the legality of the target rather than the intent of the AI's reasoning.

Hardware Requirements

To deploy Nightcrawler, the following specifications are required:

• Rooted Android Phone: Kali NetHunter installation is mandatory.
• Memory: 12GB+ RAM (approximately 1.3GB for the model, 4GB for Android).
• Optional Hardware: Ralink RT3572 USB WiFi adapter for monitor mode and WPA2 cracking.