garagehq/nightcrawler
★ 834 stars
Covered in week 2026-W37 · the 2026-09 report
Local AI powered red teamer on a phone
What nightcrawler is
Nightcrawler automates this process on a phone. It uses a small AI model (LFM2.5-1.2B-Instruct-Heretic, 1.2 billion parameters) running locally on the phone's GPU to decide what to do next — which host to probe, which tool to use, what to look for. No internet connection or cloud API required.
From the repository README · read it on GitHub →
Transcript
Pentesting usually means hauling a laptop and a cloud connection. Nightcrawler runs a 1.2 billion parameter model on the phone's GPU, deciding each move locally. It cracks WPA2, discovers hosts, probes SSH, web servers and file shares, tests default credentials, then writes the pentest report. It works slowly, building knowledge over hours — drop it, walk away, read the findings.