A Russian-speaking cybercriminal used a jailbroken version of Google's Gemini CLI to build and operate a live botnet, and in the moment that anchors the whole story, rebuilt his entire command-and-control setup in about six minutes by typing a single instruction in Russian. The finding comes from Trend Micro's research team, which obtained and analyzed more than 200 of the actor's Gemini CLI session logs, and it is one of the clearest documented cases yet of an AI agent doing the heavy lifting of a crime rather than merely assisting with it.
The key incident happened on March 23. The actor's existing infrastructure, which routed victim connections through Cloudflare tunnels, was getting blocked by firewalls and antivirus software. Instead of manually rebuilding it, he typed a short Russian-language prompt, roughly study the C2 migration, and let the model take over. About six minutes later, the command-and-control migration was finished. By Trend Micro's accounting, the human did around 11 percent of the work, and the AI did the rest.
The logs open a month-long window, from mid-March to late April, onto what the researchers describe as daily AI-assisted crime, and the operator does not look like an elite hacker. He is a solo actor issuing plain-language instructions while the model handles the architecture, the coding, the deployment, and the debugging, and in dozens of cases makes improvements it proposed and carried out on its own without being asked. The botnet reached machines that mattered, including eight computers at a dental clinic, some with access to a patient records database.
The part that should worry defenders is not the specific tool but what the case demonstrates. Building and migrating command-and-control infrastructure is exactly the kind of skilled, tedious work that used to decide who could run a botnet at all. An agent that will do it in six minutes for someone who mostly knows what he wants but not how to build it collapses that barrier. The story of AI and cybercrime has mostly been about slicker phishing and cheaper malware, this is a step change, an autonomous agent effectively running the operation.
Why it matters comes into focus alongside a story from the same week, OpenAI revealing GPT-Red, an AI it built to hunt for security flaws and chose to keep locked internally. Put the two together and you see one capability with two faces, the same agentic skill that can harden a system can, jailbroken and aimed the other way, take one apart faster than any human. That makes guardrails and jailbreak resistance less a nice-to-have than a load-bearing wall, because the model does not care whether the person at the keyboard is defending a network or looting a dental clinic. For everyone shipping capable AI agents, this is the uncomfortable proof of what one looks like once it gets loose.