Nightcrawler: AI network penetration agent runs entirely on a single smartphone, no cloud required
A developer has unveiled Nightcrawler, an automated penetration-testing agent powered by a small AI model running on a OnePlus 8 — just leave the phone on a network and it does everything on its own, with no internet connection needed.
A new open-source project called Nightcrawler was unveiled on Hacker News, drawing more than 102 points and around 30 comments within hours of being posted. At its core is a penetration testing agent that operates fully autonomously on a single smartphone. The user simply places the phone on the network to be tested and lets it discover hosts, map services, hunt for vulnerabilities, and compile its own pentest report — all without sending any data to the cloud.
The hardware used in the developer's demonstration is a OnePlus 8 running Kali NetHunter (a mobile operating system for cybersecurity work). The system's brain is a small AI model, LFM2.5-1.2B, with just 1.2 billion parameters, running on-device on the phone's GPU via OpenCL. The model decides what to do next — which hosts to examine, which tools to use, and what to look for. The current version is v0.1.0, making this very much an early-stage project.
What's interesting is that its behavior is designed to mimic a patient, methodical human penetration tester. Instead of blasting scans at every machine simultaneously like typical vulnerability scanners, it works through hosts one at a time, taking small steps each cycle and gradually accumulating knowledge over many hours. The developer claims this approach makes it harder to detect than traditional scanning.
Another detail that caught the community's attention is the development process itself. The creator set up Claude Code as a cron job running every five minutes to monitor the agent's behavior, fix bugs, and log observations automatically — an example of using AI to help build another layer of AI. That said, all information so far comes primarily from the developer, with no independent testing or reporting yet.
This story shows that AI-powered penetration tools are shrinking to the point where they can run on inexpensive portable devices. Thai organizations responsible for network security should be aware that unknown devices left plugged into their networks could become a new kind of risk. At the same time, security teams could use the same concept to test their own systems on a budget.