PromptLock: the "first AI ransomware" was a research prototype (2025)

Restricting which local AI-runtime software (such as Ollama) can be installed and run on managed endpoints, via application allow-listing and EDR alerts on new local inference-server installs, is the closest practical control since the underlying choice to run an open-weight model offline is otherwise invisible to network monitoring.

Prompt crafting happens entirely on the attacker's own machine before any contact with a target system, so there is no realistic external control at this specific stage; the nearest real lever is upstream, at model-safety training and refusal-tuning by open-weight model publishers, with Stage 1's endpoint control also mitigating by limiting where such prompts can be run in the first place.

Static antivirus and YARA-style scanning for binaries embedding clusters of ransomware-consistent natural-language prompts (encryption, ransom, exfiltration terms) alongside Ollama/LLM API client code can flag suspicious packaging before execution, even though the actual attack script is not yet generated.

Endpoint detection and response tuned to flag unexpected local processes calling a local LLM inference API, an unusual 'living off AI' pattern analogous to living-off-the-land binary monitoring, can catch the runtime code-generation step regardless of what the generated script itself looks like.

Least-privilege file access and mandatory access controls that limit which processes can enumerate and read sensitive user files reduce what an untrusted binary's AI-generated scripts can discover in the first place, independent of the AI's own decision logic.

Network egress monitoring and data-loss-prevention tooling that inspects outbound transfers for sensitive-file patterns can catch exfiltration regardless of whether the code that performed it was AI-generated or hand-written.

Ransomware-specific behavioral detection, such as canary files and alerts on rapid mass file modification or renaming, can interrupt encryption in progress without relying on a static signature for the specific AI-generated encryption routine.

Offline, tested backups and an incident-response playbook that removes any operational need to pay make the payout step moot even if a demand is received; publishing detection signatures (Filecoder.PromptLock.A) also lets anyone who encounters the sample identify it as a known, and in this case academic, artifact rather than a live threat.