US EditionESET Discovers PromptLock, the First AI-Powered Ransomware
PromptLock uses OpenAI's gpt-oss:20b model locally to generate cross-platform malicious Lua scripts, highlighting early AI-driven ransomware evolution, per ESET Research.
- Antivirus company ESET discovered PromptLock, the first known AI-powered ransomware using OpenAI's gpt-oss:20b model, reported on Tuesday.
- PromptLock uses hardcoded text prompts to run gpt-oss:20b locally on infected Windows, Linux, and macOS devices, generating malicious Lua scripts to enumerate, exfiltrate, and encrypt files.
- ESET noted PromptLock appears to be a proof-of-concept or work-in-progress as its file-destruction feature is not yet implemented, with no evidence of active widespread attacks.
- ESET told PCMag that "The attack is highly viable," while researcher John Scott-Railton warned about early threat actors using local AI models in cyberattacks.
- This finding signals emerging AI cyber threats, with OpenAI emphasizing ongoing efforts to improve model safety and limit malicious exploitation of open-source models.
24 Articles
24 Articles
ESET discovers PromptLock, the first AI-powered ransomware
ESET Research discovers PromptLock, a new type of ransomware using GenAI to execute attacks. The malware runs a locally accessible AI language model to generate malicious Lua scripts in real time, which are compatible across Windows, Linux, and macOS. PromptLock uses a freely available language model accessed via an API, meaning the generated malicious scripts are served directly to the infected device. Based on predefined text prompts, PromptLo…
ESET security company researchers have just come up with what they call the first AI-driven ransomware, named PromptLock.
Researchers flag code that uses AI systems to carry out ransomware attacks
Researchers at cybersecurity firm ESET claim to have identified the first piece of AI-powered ransomware in the wild. The malware, called PromptLock, essentially functions as a hard-coded prompt injection attack on a large language model, causing the model to assist in carrying out a ransomware attack. Written in Golang programming code, the malware sends its requests through Ollama, an open-source API for interfacing with large language models,…
Coverage Details
Bias Distribution
- 86% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
