Nightcrawler: Running an AI Pentesting Agent on Your Phone

Nightcrawler, an AI pentesting agent that runs on a smartphone using a quantized 7B-8B LLM, chains on-device inference with recon and exploitation primitives to iterate through scans and adapt techniques. The local execution ensures client infrastructure details remain private, addressing strict NDA requirements, though multi-step chains are slow and require 8GB+ RAM. The agent is suitable for quick recon and asset mapping but not deep exploitation, and authorization is still required.

Nightcrawler: Running an AI Pentesting Agent on Your Phone What the agent actually does Nightcrawler chains a quantized LLM 7B-8B range, think on-device inference with a set of recon and exploitation primitives. You point it at a target, and it iterates: scan a port, interpret the service banner, pick a technique, run it, read the response, adapt. The agent loop is the real feature here — it's not a shell script that fires the same Nmap flags every time. It behaves like a junior tester who actually checks the output instead of walking through a rigid checklist. conceptual flow of the agent loop while action := agent.plan scan results : output = run action action scan results += interpret output It's a proper agent loop, not a fancy autocomplete. Why running locally matters Most people building AI pentesting tools wire up an LLM API and call it a day. The problem nobody talks about: every prompt you send is metadata about your engagement. For clients under strict NDAs — think pre-acquisition M&A assessments, internal red team scope — shipping their infrastructure details to a third party is a hard no. Running the model on the device means the only artifact is what happens in memory. That alone makes this worth a look, regardless of hardware limits. Where it falls short and what's the ceiling The smartphone constraint is real. You're not running a 70B model here; the quantized weights keep the reasoning sharp enough for recon and targeted checks, but multi-step chains get slow and battery drains fast. Plugging in for sustained scans is mandatory. RAM matters too — 8GB+ is the sweet spot; you'll notice the model swapping and slowing down below that. What's genuinely interesting is the direction. A self-contained pentesting agent that fits in a pocket changes the baseline for field engagements. For quick recon, asset mapping, or initial vuln triage on a small internal target, this replaces carrying a laptop. Not for deep exploitation — but nothing says it's meant to be. Practical notes Authorization still applies. A local agent doesn't make unauthorized probing legal — keep this to targets you own or have written permission to test. The device constraint also means you're trading model depth for portability, which is a fine trade for scoping work but not for heavy payloads. Worth pulling the code and giving it a run against your own lab. The on-device approach signals where the whole field of agentic security is getting cheaper and more private — and that's the part that caught my attention. Next The salary inflation in AI is getting ridiculous. → /en/news/4847/