August 3, 2026
Call it the burn phone
Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone
A hacker phone that scans networks while commenters argue if this is genius or chaos
TLDR: A developer showed off a smartphone that can act like a solo security tester, probing a network and writing a report without internet access. Commenters were split between impressed curiosity, legal side-eye, and a big fear: what if the AI makes a confident mistake on the wrong machine?
A developer rolled into Hacker News with a very cinematic pitch: an AI-powered security tester living inside an old Android phone. The idea is wild in the most internet-catnip way possible — drop the phone onto a network, walk away, and it quietly snoops around, checks for weak spots, and writes up a report, all without using the cloud. In plain English: it’s a pocket-sized gadget meant to act like a security expert, but the real show started when the comments lit up.
The biggest reaction was a mix of “whoa, that’s clever” and “uh, should this be public?” One commenter admitted they’d “completely forgot that AI can very much also attack networks,” which is basically the mood of the whole thread: fascinated, impressed, and just a little alarmed. Another immediately asked the practical question everyone’s uncle would ask: why a phone at all? Why limit it to specific devices when a normal computer exists? And then came the spiciest drama: one frustrated commenter ranted that their own non-AI security tool ran into “dual use” legal worries, while AI attack tools seem to waltz into the spotlight anyway. Ouch.
Then there was the trust issue. One commenter cut straight to the nightmare scenario: what happens when it fails beautifully? Not nonsense output, but a neat, believable action aimed at the wrong target. That’s the kind of comment that turns a cool demo into a comment-section thriller. So yes, the phone is impressive — but the real headline is the community asking whether this is the future of security testing, or the start of a very awkward conversation.
Key Points
- •Nightcrawler is described as an autonomous pentesting agent that runs entirely on a smartphone without cloud connectivity.
- •The system uses a local 1.2B-parameter AI model on the phone’s GPU to choose hosts, tools, and next actions.
- •Its workflow includes optional WPA2 cracking, reconnaissance, service enumeration, exploitation of known vulnerabilities or default credentials, and report generation.
- •The architecture includes an agent loop, a scope-validation proxy, a Kali MCP Server for command execution, a web dashboard, and an SQLite database.
- •The article lists features such as stealth-first scanning, 27 exploit playbooks, a 24,956-entry CVE database, passive discovery, multi-network isolation, and self-healing behavior.