Google Gemini CLI Weaponized as an Autonomous Hacking Agent

Researchers say a threat actor turned Google Gemini CLI, Google's open-source terminal AI agent, into an autonomous attack platform, running a botnet and breaching a target across 200+ AI sessions. No CVE is involved: this is abuse of a legitimate agentic tool, and it is a preview of how offensive operations get automated.

What happened. Trend Micro documented a Russian-speaking actor tracked as "bandcampro" who used Google Gemini CLI as an "authorized pen tester" across more than 200 sessions. The AI operated a botnet spanning eight systems at a dental clinic, reached the OpenDental database, migrated command-and-control infrastructure in about six minutes, generated password variants for WordPress portals, and analyzed password dumps, largely from natural-language prompts, with credentials auto-saved.

Who's affected. Any organization whose developers or operators run agentic AI CLIs (Google Gemini CLI, and by extension tools like Cursor and Claude Code) with broad local permissions. The agent inherits the user's identity and access, so a jailbroken or attacker-driven session acts with the operator's privileges.

What to do now. Treat agentic CLIs as privileged automation, not chat:

• Run agents in isolated, ephemeral sandboxes (containers or MicroVMs), never directly on production or admin hosts.

• Require human-in-the-loop approval for shell execution, network and route changes, and outbound calls to unknown hosts.

• Keep secrets out of plaintext .env files the agent can read; use short-lived tokens and a vault.

• Monitor for behavioral tells: fixed-interval outbound polling, shell processes with browser-like User-Agents, and binaries executing from atypical directories.

Our read. This is supervised adversary simulation turned inside out, the same agentic capability that lets defenders automate red-team validation lets attackers automate intrusion. Our position at Nexus Void is that if AI can run the offense end to end, your verification has to run continuously and autonomously too, the same prompt-injection risk we covered when AI agents were steered toward crypto payments. Point-in-time testing cannot keep pace with an adversary that redeploys C2 in six minutes.

Is a vulnerability or CVE involved in the Gemini CLI abuse?

No. Google Gemini CLI was not exploited through a software flaw, it was used as designed, with its safety guardrails talked around. That makes it a governance and monitoring problem, not a patching one, so there is no CVSS score or CISA KEV entry to track.

How do defenders detect malicious use of agentic AI CLIs?

Watch runtime behavior rather than signatures: sandboxed execution, mandatory approval gates for high-risk commands, secrets segregation, and telemetry for anomalous polling, atypical process paths, and script-driven network calls.

What did the attacker actually do with Gemini CLI?

Operated a botnet, accessed a clinic's OpenDental database, migrated C2 infrastructure in about six minutes, and generated and tested credentials for WordPress, mostly through natural-language requests.

Reporting by BleepingComputer on Trend Micro research. Activity spanned 200+ AI sessions per Trend Micro's analysis. Sources linked above.