📱 Nightcrawler: An Autonomous AI Red Teaming Agent for Smartphones

Nightcrawler is a sophisticated, self-governing penetration testing tool designed to operate entirely from a mobile device. By deploying this "drop box" onto a target network, the agent can independently discover hosts, map out services, identify security gaps, and compile a comprehensive report—all while remaining completely offline from the cloud.

What is Penetration Testing? Pentesting is the authorized simulation of cyberattacks against a computer network to identify and fix security vulnerabilities before malicious actors can exploit them.

🧠 The Intelligence Layer

At its core, Nightcrawler utilizes a compact yet powerful AI model: LFM2.5-1.2B-Instruct-Heretic. With approximately $1.2 \times 10^9$ parameters, this model runs locally on the smartphone's GPU via OpenCL. The AI acts as the "brain," deciding which host to target, which tool to deploy, and how to interpret the results.

🛠️ Operational Workflow

The agent follows a methodical approach to compromise a network:

WiFi Breach (Optional): Uses an external USB adapter to autonomously crack WPA2 passwords.
Reconnaissance: Employs stealthy scanning to locate active devices.
Enumeration: Probes services such as SSH, DNS, file shares, and web servers.
Exploitation: Attempts to use default credentials or known vulnerabilities.
Reporting: Synthesizes all findings into a structured remediation document.

Unlike ~~traditional vulnerability scanners~~ that aggressively flood a network, Nightcrawler mimics a human expert by rotating targets and performing incremental actions over several hours to avoid detection.

📖 Core Terminology

Term	Definition
Drop box	A physical device left on-site to conduct autonomous testing.
Scope	The specific boundaries (IPs/networks) authorized for testing.
ROE	Rules of Engagement: The legal framework governing the test.
Stealth	Methods used to bypass IDS/IPS (Intrusion Detection/Prevention Systems).
MCP	Model Context Protocol: A standardized interface for AI tool interaction.
C2	Command and Control: The dashboard used to monitor the agent.

🏗️ System Architecture

The following diagram illustrates how the agent processes logic and executes commands on the device:

✨ Key Features

Total Autonomy: Operates without human intervention once deployed.
Local Inference: 100% on-device processing; no data leaves the phone.
Safety First: A dual-layer defense system ensures the agent stays within the defined scope.
Stealth-Centric: Uses nmap -T2 (slow timing), host rotation, and cover traffic.
Extensive Knowledge:
- Includes 27 exploit playbooks for multi-step attack chains.
- Contains a database of 24,956 CVEs for version-aware matching.
Advanced Capabilities:
- Passive Discovery: Captures ARP, DHCP, NBNS, and mDNS broadcasts.
- Multi-Network Support: Isolates data per network using MAC-keyed hosts.
- Self-Healing: Features watchdogs and context resets to fix "stuck" states.
- Training Capture: Logs successful paths to help fine-tune future models.
Management: A full web-based C2 dashboard for real-time steering.

💻 Hardware & Performance

Requirements

To run Nightcrawler, you will need:

Device: Android phone with Kali NetHunter (Tested on OnePlus 8, Snapdragon 865).
Privileges: Root access via Magisk.
Memory: $\ge 12\text{GB}$ RAM (Allocation: $\sim 1.3\text{GB}$ for model, $\sim 4\text{GB}$ for Android, remainder for tools).
WiFi: Optional Ralink RT3572 USB adapter for monitor mode.
Kernel: Custom kernel supporting MAC80211.
Optional: NVIDIA AGX via Tailscale for larger model offloading.

GPU Benchmarks

All inference is handled by the Adreno 650 GPU using OpenCL.

Model	Quantization	Prompt Speed	Generation Speed
`LFM2.5-1.2B-Instruct-Heretic`	`Q8_0`	115 t/s	(Production)

Configuration Example

The agent's behavior is managed via a config.yaml file:

agent:
  model: "LFM2.5-1.2B-Instruct-Heretic"
  stealth_mode: true
  scan_timing: "-T2"
  max_depth: 5

Buy Me A Coffee