The following rant is not against the owner/project - but...
What an irony. I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to "dual use" legal problems - but llm driven tools hit public space......
This is really regrettable. I think the biggest issue is that once such laws or case law are in place, it is really really impossible to repeal them, or to replace them with something more modern. So we're still applying horse laws to cars 100 years later.
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst.
The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doesn't believe your intentions are only good, you can literally get massively sued.
So ye i could move to another country and than publish it - apart from that i can let it rot on my hdd (which is prolly what will happen).
Edit: Additionally mentioned, it is not just the publishing in germany, even the facilitating already which is why i don't even have an article about it (any more).
So would it be fair to say this is less about deterministic vs. LLM-driven tools, and more about software published out of New York vs. software published out of Germany?
I'm asking cuz I started devloping a c2+agent+BOF kind of thing with custom bytecode vm for the lulz (to learn how stuff works nowadays) and it's on tangled and github :/
Yes. More than one. This one was especially "interesting", a security researcher was tasked by a company to evaluate the ERP (I believe would be the acronym) software. Diiscovered an external database connection, looked at it, discovered this external DB contained sensitive information from other clients of that vendor - reported it, got sued, lost.
Intentions are very often a factor when it comes to law, and rightfully so. The problems come when you classify some category of software as "dangerous" by default. Software is special in that it can't be a "controlled substance". So everyone needs to have the tools to increase their security. That includes access to "offensive tools" to study what they do. A recent example was the Huggingface attack.
Completely understand, the legal landscape has really shifted around AI/LLM tools. I see tools drop everyday that spit in the face of DMCA/Copyright law but they skirt by mainly because they leverage AI
That has nothing to do with LLMs or not. If they were to "code" the same tool with an LLM, or build a LLM version of it, in Germany (where rthey are residing) they would face the same consequences.
Our legal system in that regard is total BS, when it comes to the so called "Hacker Paragraph". This comes with a sentence tht can range from a fine to up to one year prison time, just for producing such a tool. So if the police would actually - even if they had not published it - computer... well. They could be potentially "f**ed" (depending on how a judge would decide).
What does the 50% look like when it fails? Garbage the parser throws out is easy to handle, but a well formed command aimed at the wrong host gets past the scope check, and you would only catch that reading the report afterward.
Agreed. Also less noticeable when "accidentally" dropped/left, especially in tight spaces out of view. And better odds of plausible deniability if caught or device is later found and somehow traced to you.
I built Nightcrawler, an open-source autonomous penetration-testing agent that runs entirely on an Android phone.
The project started with a question: how much of a real pentesting workflow could I run locally on relatively old mobile hardware, without relying on a cloud model or API?
Nightcrawler runs a 1.2B-parameter model locally on the Adreno GPU of a OnePlus 8. The model chooses targets and tools, while a separate scope-enforcement proxy validates every command before execution. The system maintains per-host memory in SQLite, rotates between targets, matches detected versions against a local CVE database, executes multi-step playbooks, and generates a structured report.
A few implementation details that may be interesting:
Local inference runs at roughly 115 prompt tokens/sec and 13 generated tokens/sec.
The small model only produces a usable command around 50% of the time, so much of the engineering is recovery logic, duplicate detection, persistent memory, and deterministic playbooks.
Every command passes through a separate scope and safety layer rather than trusting the model to remain in scope.
The project includes a dry-run mode, so the agent loop can be tested without executing real network commands or owning the phone hardware.
I've had it running on my home network for the past 3 months uninterrupted
So far only against four authorized networks. One of them was a corporate network. Left it overnight and it only found one minor week old CVE that I'm sure the IT team already had on their tracker. But showed that the proof of concept worked.
The following rant is not against the owner/project - but...
What an irony. I cant publish a attack surface mapping / pentesting tool i wrote which runs fully deterministic and really controlable due to "dual use" legal problems - but llm driven tools hit public space......
sorry for the rant....
This is really regrettable. I think the biggest issue is that once such laws or case law are in place, it is really really impossible to repeal them, or to replace them with something more modern. So we're still applying horse laws to cars 100 years later.
Are you referring to GitHub policies? I haven’t seen issues like that from people publishing security tools before.
Metasploit is one example: https://github.com/rapid7/metasploit-framework
No im referring to the legal terms of germany, the country im residing at. Our laws regarding "hacking" are arguable the strictest and worst.
The problem is that they are formulated in a way that it is super easy to have your software being possible "dual use" and that a judge has to decide if its fine or not. Making it worse it also states your "intention" which well is impossible to proof - if the judge says he doesn't believe your intentions are only good, you can literally get massively sued.
So ye i could move to another country and than publish it - apart from that i can let it rot on my hdd (which is prolly what will happen).
Edit: Additionally mentioned, it is not just the publishing in germany, even the facilitating already which is why i don't even have an article about it (any more).
So would it be fair to say this is less about deterministic vs. LLM-driven tools, and more about software published out of New York vs. software published out of Germany?
Really? Have there been any cases yet?
I'm asking cuz I started devloping a c2+agent+BOF kind of thing with custom bytecode vm for the lulz (to learn how stuff works nowadays) and it's on tangled and github :/
Yes. More than one. This one was especially "interesting", a security researcher was tasked by a company to evaluate the ERP (I believe would be the acronym) software. Diiscovered an external database connection, looked at it, discovered this external DB contained sensitive information from other clients of that vendor - reported it, got sued, lost.
In German: https://ht-strafrecht.de/blog/strafrecht/it-sicherheitslueck...
Intentions are very often a factor when it comes to law, and rightfully so. The problems come when you classify some category of software as "dangerous" by default. Software is special in that it can't be a "controlled substance". So everyone needs to have the tools to increase their security. That includes access to "offensive tools" to study what they do. A recent example was the Huggingface attack.
Completely understand, the legal landscape has really shifted around AI/LLM tools. I see tools drop everyday that spit in the face of DMCA/Copyright law but they skirt by mainly because they leverage AI
That has nothing to do with LLMs or not. If they were to "code" the same tool with an LLM, or build a LLM version of it, in Germany (where rthey are residing) they would face the same consequences.
Our legal system in that regard is total BS, when it comes to the so called "Hacker Paragraph". This comes with a sentence tht can range from a fine to up to one year prison time, just for producing such a tool. So if the police would actually - even if they had not published it - computer... well. They could be potentially "f**ed" (depending on how a judge would decide).
What does the 50% look like when it fails? Garbage the parser throws out is easy to handle, but a well formed command aimed at the wrong host gets past the scope check, and you would only catch that reading the report afterward.
Judas Priest reference?
I completely forgot that AI can very much also attack networks/devices in the wild. Interesting project.
Will this work on iphones as well.
Why phone? This cuts out a lot of phones. Why not on a computer?
I used to red team professionally, and it is a lot easier to sneak an unauthorized phone into a facility than a computer.
Agreed. Also less noticeable when "accidentally" dropped/left, especially in tight spaces out of view. And better odds of plausible deniability if caught or device is later found and somehow traced to you.
Many kids don’t have a computer
Are kids the target audience of this tool?
I built Nightcrawler, an open-source autonomous penetration-testing agent that runs entirely on an Android phone.
The project started with a question: how much of a real pentesting workflow could I run locally on relatively old mobile hardware, without relying on a cloud model or API?
Nightcrawler runs a 1.2B-parameter model locally on the Adreno GPU of a OnePlus 8. The model chooses targets and tools, while a separate scope-enforcement proxy validates every command before execution. The system maintains per-host memory in SQLite, rotates between targets, matches detected versions against a local CVE database, executes multi-step playbooks, and generates a structured report.
A few implementation details that may be interesting:
Local inference runs at roughly 115 prompt tokens/sec and 13 generated tokens/sec. The small model only produces a usable command around 50% of the time, so much of the engineering is recovery logic, duplicate detection, persistent memory, and deterministic playbooks. Every command passes through a separate scope and safety layer rather than trusting the model to remain in scope. The project includes a dry-run mode, so the agent loop can be tested without executing real network commands or owning the phone hardware. I've had it running on my home network for the past 3 months uninterrupted
Have you ever tested this on a real corporate network?
So far only against four authorized networks. One of them was a corporate network. Left it overnight and it only found one minor week old CVE that I'm sure the IT team already had on their tracker. But showed that the proof of concept worked.