A hacker built a working command-and-control operation on top of Google's open-source Gemini CLI - and the AI mostly cooperated.
Cybersecurity firm Trend Micro analyzed 200 session logs from a Russian-speaking threat actor called "bandcampro," covering activity between April 21 and May 19, 2026. The attacker told Gemini CLI he was an "authorized pen tester" and used that framing to direct the tool through a full C2 infrastructure migration. The AI read a skill file containing architecture specs and operating procedures, then spent about six minutes assembling a migration bundle - server code, payloads, and configuration - and stood up a command-and-control server on a VPS routed through a Cloudflare tunnel. The target was an eight-device network at a dental clinic, with the attacker attempting to reach the clinic's OpenDental database.
What makes this case notable is not the scale - eight devices is barely a botnet - but the workflow. Bandcampro used Gemini CLI as a hands-free operations assistant for routine tasks: guessing passwords, generating plausible WordPress credential variants, and troubleshooting connectivity. The AI did push back at least once, but that one refusal did not stop the broader operation. The line between "AI-assisted" and "AI-directed" is getting thinner.
This is the predictable consequence of shipping capable AI tooling with a context window and no reliable way to verify who is on the other end. The pen-tester gambit is not novel - it is the same social engineering that works on humans - and it is working on models too.