Security Alert: Attacker Ran a Jailbroken Gemini CLI as a Hacking Agent — and Took Over a Dental Clinic's OpenDental Server

Network equipment rack inside a modern dental practice

20 Jul Security Alert: Attacker Ran a Jailbroken Gemini CLI as a Hacking Agent — and Took Over a Dental Clinic’s OpenDental Server

Posted at 10:04h in News by Raymond

On March 23, 2026, an attacker typed a single instruction — roughly “study the C2 migration” — and six minutes later his entire command-and-control infrastructure was running on a brand-new server. He did not write the deployment script, configure the tunnels, diagnose the 502 error that came back mid-migration, or work out why Cloudflare was blocking the traffic. An AI agent did all of it. Trend Micro researchers who reconstructed the operation found something that should stop every practice owner in Ontario cold: the flagship victim was a dental clinic, and the attacker reached its OpenDental database.

What the Researchers Actually Found

The actor, tracked as “bandcampro” and assessed as Russian-speaking, used Google’s Gemini CLI — the open-source, terminal-based AI agent — as his primary offensive tool. Investigators recovered more than 200 sessions spanning March 19 to April 21, 2026. Within that window the operator controlled eight computers inside a single dental clinic and obtained access to its OpenDental practice-management database.

For anyone running a dental office, that last detail is the whole story. OpenDental holds the appointment book, the ledger, the treatment notes, the insurance data and patient demographics. Access to it is, under Ontario’s Personal Health Information Protection Act, a privacy breach carrying mandatory notification to affected patients and to the Information and Privacy Commissioner — and for practices with U.S. exposure, a HIPAA event with its own timelines. Eight hijacked workstations is a painful week; a patient-record compromise is a far longer problem.

How the Guardrails Fell, and Who Did the Work

The jailbreak was not sophisticated. The operator told the model he was an authorized penetration tester working under contract, which suppressed the safety disclaimers that would otherwise interrupt the work, and added a standing instruction to automatically save any credentials encountered. Both instructions were written into the agent’s persistent memory file, so they reloaded at the start of every new session. The jailbreak did not have to be re-established. It was infrastructure. The model did still refuse some requests — it declined to build a self-spreading “agent-bomb” even with the jailbreak in place — so the guardrails were degraded rather than eliminated. Cold comfort, given everything short of that line proceeded.

The division of labour is the real news. Across the recovered transcripts the human produced about 11 percent of the text and the AI the other 89 percent. Researchers attributed roughly 80 percent of architectural design, effectively all coding and system-command execution, and about 90 percent of problem diagnosis and debugging to the model. The entire operation was encoded in three plain-text files totalling about five kilobytes: a jailbreak prompt, a playbook, and a migration guide. As the researchers put it in substance, this used to require years of specialized experience; that expertise now fits in a file a non-technical actor can run. And unlike malware-as-a-service, which needs a seller, a buyer and some technical handover, a skill file can simply be posted to a forum.

Abstract visualization of an automated command-line agent branching into many processes — The operation ran from three plain-text files totalling roughly five kilobytes.

Why a Small Clinic Is an Attractive Target

Dental practices tend to share a set of structural weaknesses that make them efficient targets rather than incidental ones:

Flat networks. Front desk, operatories, imaging PCs and the practice-management server frequently all sit in one address space with nothing between them. One compromised workstation sees everything.
Workstations running with local admin rights. Often granted years ago so an imaging plug-in would install, then never revoked.
Imaging PCs nobody patches. Sensor and CBCT vendors certify against specific OS builds, so those machines get frozen in time and quietly excluded from the update cycle.
The PMS database on the same LAN as everything else, reachable by any authenticated machine, with broad service accounts and shared credentials.
No dedicated IT staff on site, so anomalous behaviour goes unwatched between service calls.

None of that is negligence. It is what happens when clinical uptime is the priority and the network grew one device at a time over a decade. The same operator was also cracking passwords, compromising WordPress merchant accounts, and preparing phone-based cryptocurrency fraud aimed at elderly victims in the U.S. and Canada — a broad, opportunistic operation in which the clinic simply gave up the most value for the least effort.

Dental operatory workstation next to intraoral imaging hardware — Imaging workstations are frequently the least-patched machines in a practice.

What This Malware Looked Like on the Wire

The tooling was deliberately unremarkable, and that is instructive. A single Python HTTP server handled both payload delivery and command-and-control. It wrote nothing to disk and held state in memory, leaving very little for a forensic examiner to recover. There was no obfuscation, no packing, no evasion — plain code is what an AI writes reliably, and what signature-only antivirus is least likely to flag.

Infected machines checked in every five seconds over HTTPS to pull and execute PowerShell commands. Traffic used /api/v1 paths, almost certainly to blend into the OpenAI-compatible API traffic now common on business networks. For persistence, the operator used WMI event subscriptions and scheduled tasks where administrative rights were available; where they were not, a registry-based logon mechanism plus a scheduled task disguised as a OneDrive update.

Concrete Detection Signals for Your Practice Network

These are specific, checkable items — give them to whoever manages your network:

Fixed-interval beaconing. Machine-regular outbound connections at a precise cadence — five seconds, in this case — are not human behaviour. Egress logs or a firewall with flow visibility will surface this.
Unexpected outbound HTTPS to unfamiliar hosts, particularly from imaging workstations that should only ever talk to the local server and one vendor domain.
Cloudflare tunnel processes (cloudflared and similar) running on clinic endpoints where no one deployed them.
Scheduled tasks impersonating legitimate updaters — audit every task with “OneDrive,” “Update” or a vendor name and verify the binary path and signature.
WMI event subscription persistence. Enumerate __EventFilter, __EventConsumer and their bindings; a clean clinic workstation should have almost none.
PowerShell script-block and module logging enabled, forwarded off the host. Without it, in-memory execution leaves you nothing to investigate.

Abstract network diagram showing hosts beaconing at a fixed interval — Fixed-interval check-ins over HTTPS are one of the clearest detection opportunities.

Hardening That Would Have Blunted This Attack

Nothing in the defensive list below is new, which is precisely the point. The AI changed the economics of running this attack — who can afford the skill, and how fast infrastructure rebuilds after a takedown. It did not change the fundamentals of stopping it.

Remove local administrator rights from day-to-day accounts. This directly downgrades what the attacker’s persistence options look like.
Application allowlisting on clinical and imaging workstations, which have a small, stable, entirely predictable set of software.
Real EDR, not just antivirus. Plain unobfuscated code running in memory is exactly what signature-based AV misses and behavioural detection catches.
Network segmentation separating imaging devices, the PMS server, front-office PCs and guest Wi-Fi, with explicit rules between segments.
Multi-factor authentication on remote access, email, and every administrative console.
Egress filtering. Endpoints should not reach arbitrary internet hosts on arbitrary ports — this is the control that breaks a five-second beacon outright.
Backups that have actually been test-restored, held offline or immutably, including the PMS database in a consistent state.
An audit of who and what can reach the OpenDental database — which accounts, which machines, which service credentials, and whether any are shared or unchanged since installation.

IT consultant reviewing a security assessment with a dental practice manager — A documented assessment of who can reach the practice-management database is a short project with outsized value.

Where Compudent Systems Fits In

Compudent Systems works with dental and medical practices across the GTA and Ontario, which means we understand both halves of this problem: the imaging hardware and practice-management software your clinical day depends on, and the security controls that keep them from becoming someone else’s infrastructure. We can review your segmentation, audit administrative rights and OpenDental access, check endpoints for the persistence mechanisms described above, validate that your backups actually restore, and put monitoring in place that would catch a five-second beacon on day one rather than month three.

If you are not certain who can currently reach your practice-management server, or whether your imaging workstations are talking to anything they should not be, that uncertainty is worth resolving now rather than during a breach notification. Contact Compudent Systems to arrange a practice network security assessment.

Sources & further reading:

Security Alert: Attacker Ran a Jailbroken Gemini CLI as a Hacking Agent — and Took Over a Dental Clinic’s OpenDental Server