Someone Created First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model

Cybersecurity firm ESET has disclosed an artificial intelligence-powered ransomware variant codenamed PromptLock, written in Golang and using OpenAI’s gpt-oss:20b model locally via the Ollama API to generate Lua scripts in real time. The malware is described as cross-platform, with scripts that can enumerate the local filesystem, inspect target files, exfiltrate data, and perform encryption, running on Windows, Linux, and macOS.

ESET noted that the Lua scripts are generated from hard-coded prompts and that IoCs may vary between executions, which could complicate threat detection. The researchers assessed PromptLock as a proof-of-concept rather than a fully operational malware deployed in the wild, and the ransomware uses the SPECK 128-bit encryption algorithm to lock files. Artifacts tied to PromptLock were uploaded to VirusTotal from the United States on 25 August 2025, according to ESET.