AI-Powered Ransomware Has Arrived With 'PromptLock'

It was probably inevitable — analysts have spotted the first known ransomware strain powered by artificial intelligence. According to ESET researchers Anton Cherepanov and Peter Strycek, PromptLock uses the gpt-oss:20b model from OpenAI locally via the Ollama API to create new scripts on the fly and in real time.

They describe PromptLock as a ransomware that is currently able to exfiltrate files and encrypt data, and is in the process of being upgraded to destroy files, though they emphasise it appears to be a PoC or work-in-progress rather than an active threat in the wild. The AI-driven ransomware reportedly writes in Go and has Windows and Linux variants uploaded to VirusTotal.

ESET also noted that the ransomware’s Bitcoin address for payments appears to belong to the mysterious Bitcoin creator Satoshi Nakamoto, a claim they shared in social posts. The researchers warned that IoCs may vary between executions, which could significantly complicate threat detection for defenders.