When ChatGPT boomed and “vibe coding” becoming a thing, the belief at large is that malware developed with AI elements is just the matter of time, and it looks like that time is already here. Security firm ESET reported that one such example has been spotted, which it named “PromptLock”.
AI Ransomware “PromptLock”
Essentially, PromptLock has static prompts “hardcoded into the malware” (hence the name), which runs on OpenAI’s open-sourced gpt-oss:20b model that can be executed locally. This allows the malware to adapt to the host system and perform necessary actions, including to “enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption.” In fact, due to the nature of LLMs, the script generated to perform such actions can vary between executions.
However, ESET assures that while the adaptive scripting nature of AI-powered malware may be difficult for antiviruses to detect on paper, there are consistent elements – in this case, the executables – that allow security software to flag them as malicious. The security firm also noted that this particular example seems to be a proof-of-concept given the lack of certain functionalities, such as the data destruction function.
While ESET researcher Anton Cherepanov concludes that PromptLock “does not pose a serious threat,” he also pointed out that it is “almost certain” that cybercriminals will be looking to utilize AI-powered malware, which will “likely become more sophisticated, faster spreading, and harder to detect.”
Pokdepinion: Unsurprising, to say the least.
