ESET discovers first ransomware that uses artificial intelligence, named PromptLock

27 August 2025 , 18:31

797     0

ESET discovers first ransomware that uses artificial intelligence, named PromptLock

Experts at ESET Research Labs have discovered ransomware in which artificial intelligence plays a key role. This is the first known virus of its kind, named PromptLock.

The ransomware contains fixed prompts that it sends to a local AI model. In response, the model generates Lua scripts in real time that scan the infected device’s file system, filter relevant data, and then either steal or encrypt it.

The virus uses one of OpenAI’s recently released open-source models — gpt-oss-20b, which came out less than a month ago. According to ESET, the scripts used by PromptLock are cross-platform and run equally well on Windows, Linux, and macOS without adaptation.

Researchers note that PromptLock currently looks more like a prototype. Evidence includes its simplistic encryption method and the fact that some built-in functions (such as data deletion) are not yet implemented. So far, ESET has also found no signs of large-scale distribution of the new virus.

Experts also revealed that one of the prompts contains a Bitcoin wallet address that may be linked to Satoshi Nakamoto, the pseudonymous creator of Bitcoin whose identity remains unknown. Journalists suggest this is likely a placeholder, further indicating that the ransomware is still in its early development stage.

Sophia Martinez

World Affairs Correspondent