PromptLock: first AI-powered ransomware (PoC) using local gpt-oss-20b
Date: 2025-08
Affected: PoC / research samples
Attack vector: tool-abuse
Category: real-world
Severity: Medium

ESET researchers discovered PromptLock, the first known AI-powered ransomware. It uses OpenAI's gpt-oss-20b locally via Ollama to generate Lua scripts at runtime for exfiltration, encryption and destruction. NYU Tandon researchers later claimed authorship as a research prototype (Ransomware 3.0).


Mitigations:

Architectural layers (MAESTRO):