Will abuse of open-source AI/LLM CLI tools for botnet operations be documented in 3+ incidents by end of 2026?

Russian-speaking threat actor 'bandcampro' used Google's open-source Gemini CLI as a hacking agent and to operate a small-scale botnet, demonstrating that public AI tools can be weaponized for command-and-control. Source: Bleeping Computer.

Resolution Criteria

Public documentation (CISA alerts, threat intelligence reports, security vendor advisories, or reputable media) of at least 3 separate incidents where open-source AI/LLM CLI tools (e.g., Gemini CLI, or similar) were confirmed operationally used by threat actors for botnet, hacking, or malware command-and-control.