Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Sign inBecome a Member
Home/AI Incident Database/"PromptLock": first known ransomware that uses a local LLM to generate its attack scripts

"PromptLock": first known ransomware that uses a local LLM to generate its attack scripts

ESET reported the first ransomware to generate its malicious code on the fly with a locally hosted open-weight model, later revealed to be an academic proof of concept, foreshadowing AI-generated polymorphic malware.

Severity: Mediumpromptlockransomwaregpt-ossollama

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incidentReport a correction or request removal

Related in AI Incident Database

Malware families PROMPTFLUX and PROMPTSTEAL call Gemini and Hugging Face models at runtime to rewrite themselves and generate commands

Google's threat group found malware that queries LLM APIs while running — PROMPTFLUX to rewrite its own code for evasion and PROMPTSTEAL (attributed to APT28) to generate Windows commands for document theft — marking…

Malware and exploit generation2025