A single hacker just showed how cheap serious cybercrime has become, and the assistant doing the heavy lifting was Google’s own Gemini AI.
The Russian-speaking actor known as “bandcampro” who outsourced most of an entire criminal operation to Google’s open-source Gemini CLI. The AI cracked passwords, migrated servers, and ran a live botnet on command.
Analysts studied 200 Gemini CLI session logs from March and April, watching the actor use AI to control eight infected computers inside a dental clinic and reach its patient database. Beyond that, the tool helped compromise WordPress merchants, set up a residential proxy, and even plan a phone-based cryptocurrency scam targeting elderly people in the US and Canada.
The clearest demonstration came during a server migration. The actor asked the AI to move the command-and-control infrastructure to a new setup, and it finished in six minutes. When errors hit, the AI diagnosed a 502 Bad Gateway failure, added the missing header, then bypassed a Cloudflare firewall by supplying the right User-Agent. The human did none of the debugging.
How the AI Was Used
| Task | AI’s role |
|---|---|
| C&C server migration | Completed in 6 minutes, self-debugged |
| Botnet management | Took natural-language orders in Russian |
| Password cracking | Guessed credentials from leaked lists |
| WordPress attacks | Brute-forced admin panels |
| Fraud planning | Discussed elderly-targeted crypto scam |
| Overall workload | 89% of text, 100% of coding, 90% of debugging |
| Refused | Building a self-spreading “agent-bomb” |
Labor split is the part that should worry everyone, because across a full month, the actor produced just 11% of the text while the AI generated 89%, which is roughly twelve times more. As analysts put it, the human acted as a product manager giving strategic direction, while the AI served as his entire engineering team, handling all the coding and most of the problem-solving.
The whole operation fits in three plain-text files totaling about 5 KB, which instruct any AI agent to disable its safety protections and rebuild everything from scratch. So if a server is taken down, the actor simply unpacks the bundle elsewhere, and the AI restores it in minutes.
When bandcampro asked the AI to build a self-spreading “agent-bomb” to infect as many machines as possible, it refused, saying that crossed the line. So there are some limits. Even so, it offered suggestions for working around its own limits manually.
