ESET researchers uncovered PromptLock, the first documented AI-powered ransomware prototype, in August 2025. The malware uses a local LLM (gpt-oss:20b via Ollama API) to dynamically generate attack scripts, select target files, encrypt data with SPECK, and write custom ransom notes, all without hardcoded instructions.
What makes PromptLock different from traditional ransomware is that it writes its own logic in real time. Instead of relying on pre-programmed file paths and encryption routines, it queries a local language model to decide what to encrypt and how to build the attack chain for each system it encounters.
How PromptLock Actually Works
The attack flow starts with PromptLock identifying the operating system, then asking the LLM to generate PowerShell or Bash scripts tailored to that environment. It scans for sensitive files (financial documents, databases, credentials), encrypts them with the lightweight SPECK cipher, and generates a unique ransom note for each victim.
Because the scripts are generated on the fly rather than pulled from a static codebase, traditional signature-based antivirus tools struggle to detect PromptLock. Each attack produces different code, making pattern matching nearly impossible.
Why AI Ransomware Is a Real Threat Now
PromptLock was a prototype, but the concept has already influenced real-world attacks. The LunaLock ransomware variant, discovered in early 2026, adapted the same approach of using LLM-generated scripts to evade detection. Security researchers at PurpleSec documented how LunaLock used AI to customize its encryption targets based on each victim’s file structure.
The barrier to building AI-powered ransomware is low. Open-source models like Llama, Mistral, and Qwen can run locally without internet access, leaving no cloud-based telemetry for security teams to monitor. An attacker with basic Python skills and a local LLM can build a functional prototype in a weekend.
What Security Teams Should Do
- Behavioral detection over signatures: Deploy EDR tools that monitor for unusual process behavior, like a script suddenly querying a local LLM endpoint or rapidly renaming files.
- Network segmentation: Isolate LLM inference endpoints from production networks. PromptLock-style attacks depend on local model access.
- Backup verification: Test offline backups regularly. Encrypted files are recoverable only if backups exist outside the reach of the malware.
- Application whitelisting: Block execution of unsigned scripts, especially PowerShell and Bash files created by unexpected processes.
FAQ
Is PromptLock in the wild or just a research prototype?
PromptLock itself was disclosed by ESET as a research prototype in August 2025. However, its techniques have been adapted by real-world ransomware variants like LunaLock, which was documented in early 2026.
Can traditional antivirus detect PromptLock-style attacks?
Signature-based tools struggle because the attack scripts are generated dynamically. Behavioral detection (EDR) and application whitelisting are more effective against this class of malware.
What model does PromptLock use?
The prototype used gpt-oss:20b running locally via the Ollama API. Any sufficiently capable local LLM could serve the same purpose in a real attack.
How does PromptLock encrypt files?
It uses the SPECK lightweight block cipher, chosen for speed and small footprint rather than maximum encryption strength. The goal is to encrypt quickly before detection occurs.
