PromptLock AI-powered ransomware prototype discovered
Researchers at New York University created a proof-of-concept ransomware called PromptLock that uses OpenAI's open-source GPT-OSS:20b model to generate malicious code via hardcoded prompts. The prototype was misidentified as functional malware when uploaded to VirusTotal for testing and does not work outside the lab environment.
What happened
Cybersecurity company ESET discovered what it called the first known AI-powered ransomware, named PromptLock, in August 2025. According to ESET, PromptLock uses OpenAI's open-source GPT-OSS:20b model to generate malicious Lua scripts via hardcoded text prompts, which then enumerate files, exfiltrate data, and perform encryption on infected systems.
An update revealed that PromptLock was actually a research prototype from New York University's Tandon School of Engineering that researchers had uploaded to VirusTotal during testing. The prototype was non-functional outside the lab environment, and its academic origin was not indicated in the uploads.
Reported impact
The malware was designed to run on Windows, Linux, and macOS systems and could exfiltrate, encrypt, or potentially destroy files on compromised computers. The code contained functionality to implement NSA-developed SPECK 128-bit encryption.
Index analysis
PromptLock used hardcoded prompts to instruct the GPT-OSS:20b model to generate Lua scripts that would execute malicious actions. The ransomware could access the model either locally on a 16GB GPU or remotely via the Ollama API through a proxy or tunnel.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.