When Malware Learns to Write Itself: Inside “PromptLock,” the First AI-Powered Ransomware Prototype
An alarming new reality emerged in August 2025 for the cybersecurity community: a ransomware prototype that creates its own attack logic, rather than depending on statically written logic. The experiment, codenamed PromptLock, is the first of its kind to use a generative AI model to generate malicious programs on the fly.
Sounds scary, doesn’t it? A locally hosted large-language model is fed predetermined prompts via PromptLock instead of fixed encryption logic. After that, the victim’s system runs the code that the model puts out in real time. Despite being in its early stages as proof-of-concept (PoC), PromptLock demonstrates a significant change in thinking by demonstrating how artificial intelligence (AI) has the potential to transform ransomware into unpredictable, flexible dangers.
The introduction of PromptLock marks a major shift in cyber threats. A lot of the older defensive tech uses heuristics, patterns, and signatures that are already known. However, identification becomes even more difficult when the malware repeatedly regenerates its own code. Both businesses and customers should see this as more than simply another version; it should serve as a warning that cyberattacks of the future may change in real-time, adjusting to overcome defenses and traditional antivirus engines.
What is PromptLock — and how does it work?
PromptLock was identified by researchers at ESET following the reappearance of samples on the public malware-analysis platform VirusTotal. The malware is developed using Go (Golang), which enables cross-platform functionality. The most innovative aspect is the utilization of a freely accessible large language model: gpt-oss: 20b, which operates locally on the compromised host through the Ollama API.
In simpler words, PromptLock is a prototype of experimental ransomware created to demonstrate the potential misuse of generative AI in cyberattacks. It operates similarly to a hacking tool in its functionality, despite being designed for academic and security research objectives.
PromptLock has pre-programmed prompts for encryption and exfiltration rather than static built-in procedures. Those commands are passed to the LLM during runtime, and it will immediately produce malicious Lua scripts as needed. These programs may snoop on file systems, determine what information to encrypt or exfiltrate, and even write personalized ransom letters. The layout of the program is designed to be polymorphic, meaning that it may produce scripts with varied behavior patterns with each run.
Technically, although PromptLock locks files using SPECK 128-bit encryption, the encryption methods itself are not statically encoded; rather, the LLM’s coordinated Lua scripts execute the encryption instructions. This design makes it far more difficult to detect using conventional signature-based defenses by essentially decoupling harmful activity from fixed binaries.
Despite its degree of complexity, experts stress that PromptLock is still in its proof-of-concept stage and has not been detected in any current ransomware schemes as of yet. But the proof-of-concept shows a new and scary threat model: AI-native malware. This kind of malware may change fast, get past static safeguards, and make complex ransomware much easier to create.
What PromptLock exactly does is:
- It encrypts files
- It generates malicious scripts using AI
- It demands ransom (in concept)
- It evades traditional detection methods
Why PromptLock matters: a shift in threat landscape
Beyond its uniqueness, PromptLock is significant because it marks a change from static malware to dynamic, AI-driven threats. Classical ransomware relies on pre-existing cryptographic fingerprints, predictable behavior, and unchanging code. Sandboxing, behavior detection, heuristics, and signature databases are the tools that defenses use.
According to PromptLock, those assumptions are false. Due to the dynamic generation of the malicious scripts, every infection could seem differently. These may be the indicators of compromise (IoCs) and they may vary too. It becomes useless to use hash-based detection. Problems may arise with behavior-based detection systems when trying to account for environments, file types, operating systems, or human actions that cause behavior to shift.
What’s more concerning is the relative simplicity of deployment. Virtually anybody with a little knowledge of malware could construct an AI-powered ransomware using open-source tools, public APIs, and cross-platform scripting languages. Instead of the traditional hurdles, such as scripting knowledge and encryption, straightforward rapid engineering is used. Cybercriminals have a much easier time using these technologies, as warned by ESET researchers.
Put simply, while PromptLock is now only a research project, it anticipates a future when artificial intelligence simplifies and reduces the cost of crimes, allowing a greater number of attackers to launch considerably more damaging attacks.
Why was this dangerous prototype built?
Despite its ransomware-like functionality, PromptLock was created to:
- Deploy a model for future threats (AI-native malware)
- Keep defenders informed about potential attacker’s use of LLMs
- Insist that cybersecurity teams reconsider their approaches to detection
- Promote AI-related policy and ethical debates
Imagine it as a "crash test dummy" for cybersecurity; intentionally risky, yet built to prevent more
serious disasters.
Sources & References
https://www.eset.com/us/about/newsroom/research/eset-discovers-promptlock-the-first-ai-powered-ransomware/
https://www.theregister.com/2025/08/26/first_aipowered_ransomware_spotted_by/
https://cybersecurefox.com/en/promptlock-ai-powered-llm-ransomware-nyu-tandon-eset-analysis/
https://thehackernews.com/2025/08/someone-created-first-ai-powered.html
https://aviatrix.ai/blog/promptlock-ai-powered-ransomware/
https://www.infosecurity-magazine.com/news/first-ai-powered-ransomware/
Leave a Reply