Start with the evidence
ESET researchers reported PromptLock in August 2025 as the first known AI-powered ransomware and described the observed sample as a proof of concept or work in progress. It generated malicious Lua scripts dynamically, but that finding is not evidence of a widespread operational ransomware campaign.
Documented AI misuse is a separate risk
Anthropic has separately documented malicious use of Claude in cybercrime and extortion-related activity. Those cases show that generative AI can augment existing cyber operations, but they are separate from PromptLock and should not be read as evidence that Claude powered PromptLock.
A practical protection checklist
CISA ransomware guidance emphasizes keeping software patched, maintaining tested offline encrypted backups, using phishing-resistant MFA where possible, using strong unique passwords and password managers, and running security-awareness training. Apply controls to the systems and threat model that actually matter to your organization.