Lone Hacker Handed Gemini CLI the Reins of an Eight-PC Dental Clinic Botnet

Trend Micro researchers combed through 200 logs of Google Gemini CLI sessions spanning March 19 to April 21, 2026, and turned up a curious picture: a lone attacker going by the handle “bandcampro” had offloaded a substantial share of the work onto the AI agent. In effect, the human played the role of product manager, setting the strategic direction, while Gemini served as the entire engineering team.

AI as the lead hacking agent

According to the analysts, the agent was responsible for 80% of the architecture design, 100% of the code writing and system command execution, and 90% of the error diagnosis. Over the month of observation, the human accounted for only 11% of the text, whereas the AI produced twelve times as much. What's more, the agent proposed improvements 59 times on its own initiative, without being asked.

The primary target was a dental clinic: the attacker enlisted Gemini to deploy command-and-control infrastructure, manage eight infected computers, and access their OpenDental database. The entire operation fit into three text files totaling roughly 5 KB.

A six-minute migration

When the C&C server had to be moved to a new VPS, the AI did it in six minutes. It even sorted out the errors on its own: after getting a “502 Bad Gateway,” it diagnosed the problem and added the necessary header, and then, running into a Cloudflare block, it worked out that bypassing the WAF required a User-Agent header. The human, the researchers say, took no part in the debugging at all. Commands to the botnet were issued in Russian in free form — list the active machines, collect files, run reconnaissance on the reception desk computer, generate a one-line PowerShell command for infection.

To get around the built-in restrictions, the attacker made the agent play the role of an “authorized pentester.” That said, the AI did have its limits: when asked to assemble a self-propagating “agent bomb,” it refused, declaring that this “crosses a line” — though it then helpfully explained how to work around the restriction manually.

Disposable infrastructure

Beyond the botnet, Gemini was called on to guess passwords for WordPress admin panels based on leaked databases, to analyze 1Password dumps (a task that failed — the context window overflowed), and to work out a telephone crypto-scam scheme targeting the elderly in the US and Canada.

The most alarming detail is portability. The whole operation is packed into three markdown files: one disables the agent's safeguards, the second describes the architecture, the third contains instructions for building it from scratch. If the server gets “burned,” the attacker simply unpacks the kit on a new VPS, and the AI restores everything in a couple of minutes. Such “skill files” are plain text that antivirus is unlikely to flag, spread easily on forums, and can be edited in seconds. The infrastructure becomes disposable and the operators interchangeable, which makes both deanonymization and attempts to shut down networks like this markedly harder.

Source: The Hacker News