Nonetheless, our findings remain valid – the discovered samples represent the first known case of AI-powered ransomware. ESET researchers have discovered what is the first known AI-powered ransomware. “The PromptLock malware uses the gpt-oss-20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes. "The PromptLock ransomware is written in Golang, and we have identified both Windows and Linux variants uploaded to VirusTotal," added the researchers. To learn about the latest trends on the ransomware scene and the broader threat landscape, read ESET's H1 2025 Threat Report.