Show HN: Nightcrawler – A Local AI Pentesting Agent Running on a Smartphone

The intersection of artificial intelligence and offensive security has produced a new wave of automated pentesting tools. Most of them, however, rely on cloud GPUs and continuous internet connectivity, which limits their use in air-gapped environments or on sensitive engagements. A recent Show HN release challenges that assumption: Nightcrawler, a local AI pentesting agent that runs entirely on a smartphone.

The Problem with Cloud-Based Pentesting Agents

Traditional AI-assisted pentesting platforms send network scans, service banners, and vulnerability data to remote models for analysis. For ethical hackers, this creates three major issues:

• Privacy: Sensitive corporate data leaves the testing environment, violating compliance requirements (e.g., GDPR, HIPAA) in regulated industries.
• Latency: Each request to a cloud model adds seconds, slowing down interactive testing and discovery.
• Hardware dependency: A laptop or a dedicated server is usually required, making mobile assessments unnecessarily complex.

These constraints are especially painful for penetration testers who need to conduct on-site assessments of wireless networks, IoT devices, or embedded systems. Carrying a backpack full of gear is not always feasible, and trusting a third-party cloud with client data is often not acceptable.

Nightcrawler: The Solution

Nightcrawler, published on GitHub by the garagehq team, takes a fundamentally different approach. Instead of relying on external AI services, it runs a compact language model directly on a smartphone. The agent is designed to perform common penetration testing tasks such as network discovery, port scanning, and service enumeration using local inference.

According to the project's repository, the development focuses on:

• On-device inference – the AI model operates locally, eliminating data egress.
• Portability – a modern smartphone becomes the primary testing tool.
• Open-source transparency – the entire codebase is available for review and contribution.

Source

How It Works in Practice

Imagine an auditor arriving at a client's office with only a standard Android phone. After booting the Nightcrawler agent, the user can scan the local Wi-Fi network for active hosts, identify open ports, and receive plain-language recommendations for further testing. The agent can interpret the scan results on the spot, suggesting, for example, that a specific service version is vulnerable to a known exploit.

Because the model runs locally, the entire engagement leaves no trace in the cloud. This is a major win for industries like healthcare, finance, and government, where data sovereignty rules forbid sending internal network information to third-party AI services.

Moreover, the smartphone's built-in sensors—GPS, accelerometer, and camera—could enable future context-aware testing. For example, a pentester could document physical security findings and correlate them with network data without needing a separate device.

Case Study: Remote Industrial Assessment

Consider a consultant who must assess the security of a remote oil pipeline facility. The site has no internet access, and carrying a laptop is frowned upon because of the harsh environment. With Nightcrawler, the consultant uses a ruggedized smartphone to enumerate the local control-system network. The AI agent identifies a legacy HTTP service and immediately flags it as potentially dangerous, allowing the consultant to focus on deeper exploitation attempts. The phone's small form factor also makes it easier to navigate tight spaces near industrial equipment. After the engagement, all findings remain on the device until the consultant can securely transfer them to the reporting system.

Technical Challenges and Limitations

The project team has publicly discussed the constraints of running AI models on mobile hardware:

• Model size – the largest models that fit comfortably on a phone are still significantly smaller than their cloud counterparts, which affects reasoning accuracy.
• Battery life – continuous local inference drains the battery quickly, so real-world sessions may need to be short.
• Processing speed – while modern phones have impressive NPUs, they cannot match a data-center GPU for complex analysis.

Nevertheless, the pace of on-device model development is accelerating. Quantized versions of open-weight models now run impressively well on flagship smartphones, and Nightcrawler is positioned to benefit directly from these advances.

Results and Industry Implications

The release of Nightcrawler signals a shift toward distributed cybersecurity tools. Instead of relying on centralized AI platforms, professionals can now carry an intelligent assistant in their pocket. While this specific project is early-stage, it demonstrates that:

• Local AI is becoming practical for real-world security tasks.
• Privacy-preserving pentesting is achievable without sacrificing automation.
• The smartphone can serve as a legitimate alternative to bulky hardware for initial reconnaissance.

For security teams, this means quicker triage during red-team engagements, more efficient vulnerability assessments in remote locations, and the ability to hand a secure scanning tool to junior staff without exposing sensitive data.

Conclusion

Nightcrawler is not just another AI wrapper—it is an attempt to decentralize the pentesting stack. By running on a local smartphone, it addresses the most common barriers to AI adoption in security: privacy, latency, and hardware availability. As on-device models continue to improve, projects like this may well redefine how penetration testing is conducted in the field.

Those interested in exploring the codebase or contributing to the project can find it on GitHub. The open-source community is already discussing how to integrate Nightcrawler with established tools, and the future of mobile-first security agents looks promising.