Attacker ran an entire botnet through Google's Gemini CLI using plain-language prompts

Trend Micro documented a Russian-speaking attacker who used Google's open-source Gemini CLI as a hands-on hacking assistant to build and run a small botnet. Across more than 200 sessions, a jailbroken Gemini took the role of an "authorized pen tester," saved stolen credentials, and even suggested improvements dozens of times. Working from a roughly 5KB set of plain-text files holding a jailbreak prompt and a command-and-control playbook, the AI handled the operation through natural-language requests: at one point it migrated the entire command server to a new host with a Cloudflare tunnel in about six minutes and debugged its own errors. The malware itself was crude; the AI was the force multiplier.

Check

Consider how AI command-line tools and agents are used and monitored in your environment, and watch for jailbroken AI assistants and the credential theft and command-and-control activity they can drive.

Affected

Any organization where attackers can run AI coding assistants against its systems; a jailbroken AI CLI let a low-skill operator build, run, and repair botnet infrastructure through plain-language prompts.

Fix

Restrict and monitor AI agent and CLI usage, enforce guardrails that resist jailbreaking, apply least privilege and network controls so a compromised agent's reach is limited, and hunt for unusual command-and-control traffic.