What Is PromptLock and How Does It Use AI-Generated Code

A new ransomware variant called PromptLock has become the first known malware to rely on large language model output to generate its own attack code. Rather than shipping with fixed, pre-written scripts, PromptLock uses AI-generated Lua code to handle file discovery, data exfiltration, and encryption, the core stages of a ransomware attack.

Lua is a lightweight scripting language often used in games and embedded systems because it's fast, portable, and easy to run across different platforms. By having an LLM generate Lua scripts on the fly, PromptLock's operators can produce functional attack code without hand-coding every variant themselves. This is a meaningful departure from how ransomware has traditionally been built, and it's why security researchers are treating PromptLock as a signal of where the threat landscape is heading, not just another isolated incident.

Why AI-Written Malware Is Harder for Antivirus Tools to Detect

Most antivirus and endpoint detection tools still lean heavily on signature-based detection: they look for known patterns, hashes, or code structures that match previously catalogued malware. That approach works well against static, reused code. It struggles against code that changes every time it's generated.

When an LLM produces the Lua scripts that drive file discovery, exfiltration, and encryption, each generated instance can differ slightly in structure and syntax while still achieving the same malicious outcome. That variability undermines signature matching and makes behavioral analysis more important, and more difficult, since defenders need to recognize the intent behind the code rather than the code itself. This is the central challenge in AI-generated ransomware detection: the malicious logic is consistent, but its expression is not.

How This Changes the Ransomware Threat Landscape

PromptLock's approach matters beyond its own specific campaign. If AI-generated code becomes a standard tool for building ransomware components, it lowers the technical barrier for creating new variants and speeds up the pace at which attackers can iterate. A ransomware operator no longer needs deep scripting expertise to produce functional file discovery or encryption routines. They need access to an LLM and the ability to steer its output toward malicious ends.

This shift affects individuals and organizations differently, but both face a common problem: detection tools built around static signatures are less reliable when the underlying code generation process is dynamic. For businesses, this means ransomware campaigns already causing real damage, like the incident covered in Deutsche Bank Ransomware Claim Rocks July 2026 Cyber Week, could become more frequent or harder to attribute as attackers adopt AI tooling to accelerate development. For individual users, it means the ransomware that eventually reaches a home network or personal device may not match any previously known signature at all.

Practical Defenses: Backups, Segmentation, and Where VPNs Fit

The good news is that the fundamentals of ransomware defense don't change just because the code generation method has. What changes is how much weight those fundamentals now carry, since signature-based detection alone is no longer sufficient.

Backups remain the single most important defense. Regular, tested, offline or immutable backups mean that even if ransomware successfully encrypts files, you can restore them without paying a ransom. Backup hygiene should include verifying that restores actually work, not just that backups are being created.

Network segmentation limits blast radius. Whether in a home setup or a business environment, separating critical systems and sensitive data from general-purpose devices reduces how far a ransomware infection can spread once it gains a foothold.

VPNs play a supporting role in a layered strategy. A VPN won't stop ransomware from executing on a device that's already been infected, but it does reduce exposure by encrypting traffic between your device and the network, which matters when connecting over public or unsecured Wi-Fi where initial compromise often begins. Combined with endpoint protection, patched software, and cautious handling of email attachments and links, a VPN is one layer among several, not a standalone fix.

What This Means For You

If you're an individual user, the practical takeaway is that no security tool is a silver bullet, and that's especially true now that AI-generated ransomware detection has to contend with code that doesn't look like anything seen before. Keep backups current, be skeptical of unexpected attachments and links, and use a VPN as part of a broader set of habits rather than a replacement for them.

If you manage IT for a business, this is a good moment to review how much your detection stack depends on signature matching versus behavioral analysis, and to confirm that backup and recovery procedures have actually been tested recently, not just configured and forgotten.

Actionable Takeaways

  • Maintain offline or immutable backups and test restores regularly, since AI-generated ransomware can bypass signature-based detection but not a clean backup.
  • Use network segmentation to limit how far an infection can spread if it does get through.
  • Treat VPN use as one layer in a broader defense strategy, especially on public or unsecured networks, not a complete solution against ransomware.
  • Stay informed on ransomware incidents affecting major organizations, since they often reveal the tactics and consequences that eventually trickle down to smaller targets and individual users.
  • Keep endpoint protection and operating systems updated, since AI-generated code still needs a vulnerability or user action to gain initial access.