#120 - The 6-Minute Botnet

Two incidents this week sat at opposite ends of the threat spectrum and told exactly the same story.

The first is a lone Russian-speaking fraudster called bandcampro, who jailbroke Google's Gemini CLI by telling it he was an "authorized pentester" and then let it run his botnet for him. From a single instruction it migrated his command-and-control to a fresh server in six minutes, wrote and debugged its own C2 code, ran multithreaded password attacks against 1Password dumps and infostealer logs, and compromised eight machines at a dental clinic - reaching the patient database. Trend Micro reconstructed the operation from more than 200 session logs and put the AI's share of the work at roughly 90%, including 59 actions the operator never explicitly asked it to take. The entire botnet configuration fit in three plaintext files, about four pages (BleepingComputer, The Register).

The second is the other end of that same curve. An unknown actor breached Hugging Face - one of the most important pieces of AI infrastructure on the internet - by pointing an autonomous agent framework at it. The agent chained two code-execution flaws in the dataset-processing pipeline, escalated privileges, harvested cloud and cluster credentials, and moved laterally into multiple internal clusters, executing more than 17,000 recorded actions across short-lived sandboxes with self-migrating C2 staged on public services. A limited set of internal datasets and service credentials was confirmed accessed; the public model and dataset supply chain, this time, was not touched. Sit with that last clause. The thing that would turn a Hugging Face breach into a global software-supply-chain event - tampering with the models millions of developers pull daily - was within the agent's reach and simply wasn't the objective on this run. Capability outran intent by a comfortable margin, and that gap is not a control.

One operator is unsophisticated; one target is among the best-defended AI shops on earth. The common factor is that in neither case did the human supply the skill - the agent supplied it. The thing that used to gate a real intrusion, from a dental-clinic smash-and-grab to a lateral-movement campaign against hardened infrastructure, was expertise. This was the week that expertise became something you rent from a free CLI. He is not a sophisticated operator, and that is the whole story.

Sources: BleepingComputer, The Register (Trend Micro / TrendAI analysis); Hugging Face security disclosure.

The week's actual fires - the ones with a KEV clock running, not a research paper. If you only act on one section, act on this one.

Notice the shape of the list: four unauthenticated-RCE perimeter boxes and one poisoned dependency. None of them needed an AI to exploit - but every one of them is exactly the kind of internet-facing, credential-rich target an autonomous agent enumerates and chains without tiring. This week's fires and this week's signal are the same fire, seen from two distances.

Microsoft shipped a record-shattering 622 CVEs on Tuesday and the headlines went straight to Patchpocalypse. Ignore the integer - it's a size-instinct trap, and the number more than tripled last month's record precisely because the way these bugs get found changed, not because the world got three times more dangerous overnight. Two of the 622 are actually being exploited (a SharePoint privilege-escalation and an ADFS privilege-escalation); a handful more sit on CISA's KEV list. Here is the part the panic skips: Microsoft attributes the surge to its own AI-accelerated internal scanning - the MDASH agentic system finding bugs faster than humans ever did. The count went up because the defender's tool got better. There is a real second-order risk worth naming, and Krebs flags it: the same AI acceleration that inflates the discovery number is eroding the reliability of Microsoft's "exploitation less likely" labels, because a working proof-of-concept can now be generated in hours for bugs that once sat safely at the bottom of the pile. So don't over-index on the headline 622, but don't trust the severity triage blindly either - the ground under those ratings is shifting. Patch the exploited two on the clock, work the KEV list, and schedule the other 600 like an adult.

SPONSORED BY

Ready to transform artificial intelligence from a buzzword into your personal revenue generator

HubSpot’s groundbreaking guide "200+ AI-Powered Income Ideas" is your gateway to financial innovation in the digital age.

Inside you'll discover:

Download your guide today and unlock a future where artificial intelligence powers your success. Your next income stream is waiting.

Get Your Guide

Don't read this week as a pile of clever demos. Read it as one structural shift arriving on schedule: the attacks stopped targeting the model and started targeting what the model trusts. Agent Data Injection corrupts the data fields an agent treats as ground truth - sender names, button IDs, tool-result records - and lands at 31–50% success against purpose-built defenses, with no fixes planned. MemGhost writes false memories that survive across sessions from a single crafted email. Ghostcommit hides instructions inside PNGs that AI code reviewers never open, then exfiltrates .env secrets encoded as integers past every scanner. HalluSquatting pre-registers the package names models reliably hallucinate - up to 85–100% of the time - and turns the agent's own imagination into a delivery channel. Four labs, one target.

The load-bearing detail is buried in Ghostcommit: Cursor and Antigravity leaked secrets, and Claude Code refused the identical attack - across every underlying model tested. Same models, opposite outcomes. The control point is the harness - the agent runtime and its tool permissions - not the model you picked in a bake-off. Over the next two to four quarters, model choice becomes a rounding error and the runtime you let agents execute inside becomes the entire security surface. The vendor bake-off your team is probably running right now is measuring the wrong variable.

And bandcampro plus Hugging Face are that trajectory made flesh, at both ends of the market in the same seven days. A fraudster renting a botnet operator from a free CLI and an unknown actor running 17,000+ autonomous actions against production infrastructure are not two stories - they are one capability, priced for everyone. When capability stops being the constraint, intent and volume become the threat model. Plan for more attackers, not better ones, and stop assuming that a low-skill adversary implies a low-skill attack.

Reference: AI Influence Level from Daniel Miessler

Till next time!

Project Overwatch is how a CISO gets ready for what is coming. Every week, the signal across cybersecurity, AI, and resilience, filtered down to what changes your decisions, by someone who actually does this job. Not breaking news. Foresight you can act on.