PromptLock: AI-Generated Ransomware Proof-of-Concept Discovered on VirusTotal

What Happened

In late August 2025, ESET Research discovered ransomware samples on VirusTotal that it named "PromptLock" and described as the first known AI-powered ransomware. Written in Go with confirmed Windows and Linux binary samples (ESET's press release describes the AI-generated Lua scripts, not a discovered binary, as macOS-compatible), PromptLock did not hard-code its malicious logic; instead it fed pre-written natural-language prompts to a locally-run open-weight AI model, gpt-oss:20b, accessed through the Ollama local-inference API, and had the model generate Lua scripts at runtime to enumerate files, inspect their contents, decide whether to exfiltrate or encrypt them, and carry out SPECK-128 encryption. A destructive/wipe capability existed in the code but was not yet active. ESET publicly announced the find on August 27, 2025, emphasizing it was likely a proof-of-concept rather than an operational attack tool, since it had not been observed in real attacks. On September 3, 2025, ESET updated its research after being contacted by the authors of a contemporaneously published academic paper, "Ransomware 3.0: Self-Composing and LLM-Orchestrated" (NYU Tandon School of Engineering), whose prototype closely matched the VirusTotal samples, strongly indicating PromptLock was the researchers' own test upload rather than a criminal creation. No confirmed real-world victim, ransom payment, or law-enforcement case is associated with PromptLock; it functions in this repository as a case study in how locally-run AI models can be prompted to generate functional attack logic on demand, a novel variant of AI manipulation distinct from cloud-hosted-model jailbreaks (contrast with Anthropic's separately reported GTG-2002 case, where a threat actor used the hosted Claude Code service, not a local model, to automate an extortion campaign).

How the Attack Worked

PromptLock is a Go-language ransomware sample with confirmed Windows and Linux binary variants (ESET states the AI-generated Lua payload scripts are also macOS-compatible, though no macOS binary sample was reported). Instead of shipping its malicious logic as static, hard-coded code, it embeds natural-language prompts and, at runtime, sends them to a locally-run open-weight AI model (gpt-oss:20b) via the Ollama local-inference API. The model responds by writing Lua scripts on the fly, which the malware then executes to enumerate the local filesystem, inspect candidate files, decide (autonomously, per ESET) whether to exfiltrate or encrypt each target, and carry out encryption using the SPECK 128-bit cipher. A destructive "wipe" function was present in the code but not yet wired up/active at the time of discovery. Because the AI does the code-generation work at execution time rather than the attacker doing it in advance, static signature detection is far less effective, and the same prompt logic can be reused across operating systems since the model rewrites the implementation each time. ESET researchers Anton Cherepanov and Peter Strýček discovered Windows and Linux samples on VirusTotal in August 2025 and classified them as Filecoder.PromptLock.A. On September 3, 2025, ESET updated its writeup after being contacted by the authors of the academic paper "Ransomware 3.0: Self-Composing and LLM-Orchestrated" (NYU Tandon School of Engineering: Md Raz, Meet Udeshi, P. V. Sai Charan, Prashanth Krishnamurthy, Farshad Khorrami, Ramesh Karri), whose research prototype closely matched the VirusTotal samples, indicating the "malware" ESET found was very likely the researchers' own non-functional test upload rather than a criminal tool.

The Lure & the Tell

There is no human lure here: the "target" being manipulated is the AI model, not a person. The malware's authors embedded hard-coded natural-language prompts designed to get a general-purpose local model to produce working malicious Lua code for file discovery, exfiltration, and encryption on request, without the model refusing. The "tell" that exposed this as a proof-of-concept rather than a real attack: the destructive/wipe function was present but not implemented, the ransom note pointed to a well-known Bitcoin address linked to Satoshi Nakamoto rather than an attacker-controlled wallet, the samples were uploaded to VirusTotal (a place researchers routinely test detections, not where attackers deploy live payloads), and the code closely mirrored a contemporaneously published academic paper out of NYU Tandon whose authors confirmed they had uploaded a non-functional prototype during testing.

Outcome

PromptLock was never observed being deployed against a real victim. ESET publicly disclosed it on August 27, 2025 as "the first known AI-powered ransomware," publishing IOCs and detection names (Filecoder.PromptLock.A) to let the security community detect the samples. On September 3, 2025, ESET updated its findings after NYU Tandon researchers came forward, confirming the VirusTotal samples closely matched their own academic prototype from the paper "Ransomware 3.0: Self-Composing and LLM-Orchestrated," which they said had been uploaded to VirusTotal during testing and was non-functional/lab-only. ESET maintained that its technical findings (the malware's design and capability) remained valid regardless of authorship, and used the case to warn that AI models can now generate ransomware-class logic at runtime, lowering the technical bar for attackers and complicating static detection. No prosecutions, ransoms, or victim organizations are associated with this case.

Why It Matters

PromptLock demonstrates a technically novel and lower-barrier evolution of the "AI as attack-enabler" pattern: instead of a human attacker socially engineering a hosted AI provider's safety controls (as in cloud-based jailbreak/agentic-abuse cases), the malware itself carries prompts that get a locally-run, open-weight model to write functional malicious code at the moment of execution, on the victim's own machine, with no dependency on or visibility to a cloud AI provider's abuse monitoring. This defeats static-signature detection (the actual malicious script does not exist until generated), can in principle be ported across operating systems from one prompt set (though only Windows and Linux binaries were actually recovered), and shows how open-weight models can be repurposed as offline "malicious code compilers." Even though PromptLock itself was academic research rather than a live attack, ESET's framing, "the threat it represents is very real," and its near-simultaneous parallel to the real-world, Claude-orchestrated GTG-2002 extortion campaign reported by Anthropic the same month, together signal that AI-assisted, runtime-generated malware logic is moving from theoretical to demonstrated-feasible, which is why security teams and AI providers began watching for both hosted-model abuse and local-model abuse patterns.

Defenses

ESET published file hashes and detection names (Linux/Filecoder.PromptLock.A, WinGo/Filecoder.PromptLock.A) so the samples are now signature-detected; the episode pushed the case for behavioral/EDR detection of local calls to LLM runtimes (e.g., unexpected process calls to an Ollama API) and of dynamically-generated/self-modifying scripts rather than relying on static payload signatures; ESET and other vendors used the discovery to argue for monitoring "living off AI" patterns (a local model used as an execution engine) the same way defenders watch for "living off the land" binaries; the academic authors argue this class of threat requires new detection research since the actual malicious code does not exist until runtime. No PromptLock-specific victim remediation was needed since no confirmed victim exists.