An MI5 desk officer suspected one of the 7/7 bombers was a trained terrorist two months before the attacks.
The inquests into the 2005 suicide bombings heard how the officer made an "intuitive" link between fragments of intelligence about suspects.
The connection was made while Mohammad Siddique Khan was preparing for the attacks.
But an MI5 witness said that at the time they had no proof who Khan was and whether he was a danger to the UK.
The bomb plot ringleader, Khan killed himself and six others when he detonated his homemade rucksack bomb on a westbound Circle line train at Edgware Road station.
The inquest has been hearing from Witness G, a senior MI5 officer who is chief of staff to MI5 Director General Jonathan Evans.
Questioned by a counsel for the families, Witness G told the inquests that in the spring of 2005 officers were trying to establish the real identities of a pair of men who had attended a terrorist training camp in Pakistan two years previously.
MI5 had been told that the UK men had used the names "Ibrahim" and "Zubair" and that they had come from West Yorkshire. In May 2005, three Leeds men were flagged up by a desk officer at MI5's headquarters as "possible candidates" for the mystery pair.
They had appeared on "the periphery" of Operation Crevice, the 2004 fertiliser bomb plot which was successfully foiled by the police and security services.
The three men pointed out by the officer included Mohammad Siddique Khan - although his complete identity and terrorist credentials were not established until after the attacks.
Witness G said: "That was an intuition by the desk officer at the time who remembered the northern figures."
Patrick O'Connor QC said: "That was an accurate intuition and a tribute to him."
"Yes it was indeed," said Witness G.
Mr O'Connor suggested that if the officer's guess had been followed up they would have "reached the jackpot". The crucial mistake, he argued, was a failure to check the passenger list for an important flight that had taken British men to Pakistan for the 2003 camp. Had that list been checked, Khan's name could have been seen alongside a known plotter.
Witness G said: "If it had been worked in that way, yes. It would have been unusual to work further on that intuition because of the strong contra-indicators."
Witness G said that two key informants, both of whom would have known the true identities of Ibrahim, had not identified any of the Leeds men from surveillance photographs.
But earlier in the week, the inquests heard that MI5 had "obliterated" any useful information from the photos shown to the detainees in an effort to disguise how they had been taken.
He was also questioned by the coroner about why the security service had allowed the Intelligence and Security Committee (ISC) to report that Khan and Shehzad Tanweer had been categorised as "desirable" rather than "essential" targets, even though it has now emerged that the terms were not used by investigators.
"I think it's a reflection of an attempt by the ISC and us to write in a way that would be seen as helpful and accurate," said Witness G.
Lady Justice Hallett said: "I think we all proceeded on the basis that somehow these had been categories used operationally and it is a shame perhaps that the impression was left to lie."
Last month, the coroner Lady Justice Hallett granted a request from Home Secretary Theresa May for Witness G to give evidence anonymously.
But she refused to rule that the witness should be screened from the families of those who died.
Four suicide bombers detonated their devices on London's transport network on 7 July 2005.
Siddique Khan, 30, Shehzad Tanweer, 22, Hasib Hussain, 18, and Germaine Lindsay, 19, targeted Tube trains at Aldgate, Edgware Road and Russell Square, and a bus in Tavistock Square.