Nightcrawler is an autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a target network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report—all without cloud connectivity. Running on an One Plus 8 with a Snapdragon 865, it uses the LFM2.5-1.2B model on the device’s GPU, making inference local and eliminating external APIs. The agent follows a patient, human‑like loop: it rotates across hosts, performs one small action per turn, and builds knowledge over hours, making it far harder to detect than bulk scanners.

The workflow begins with optional Wi Fi breach mode, where it can autonomously crack WPA2 networks via an external USB adapter. It then conducts stealthy reconnaissance, enumerates services, exploits known vulnerabilities, and finally compiles a structured report with remediation advice. The design includes a two‑layer safety system that blocks out‑of‑scope actions and a web dashboard for real‑time monitoring.

Key features include a 24,956‑entry CVE database, multi‑step exploit playbooks, passive discovery from mDNS/NBNS/DHCP/ARP broadcasts, and self‑healing mechanisms. Hardware requirements are modest—an Android phone with Kali Net Hunter, 12 GB+ RAM, and optional USB Wi‑Fi adapter. The system is fully autonomous, 100 % local inference, and the source is open‑source with detailed documentation.