The security firm Check Point showed that an AI chatbot can generate working ransomware that runs entirely inside your web browser, with no app to install and no security bug exploited. It is a proof of concept, not a real-world outbreak, and it still needs you to click Allow. But it is a clear preview of where AI-assisted malware is heading, and it hinges on one browser permission most people have never thought about. Here is what happened, how the attack works, and how to protect yourself.
What Check Point found
Check Point published a report titled Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique. They analysed a malware sample generated with the Chinese AI model DeepSeek that connected a theoretical idea to a working method. Their conclusion, in their words: AI can turn high-level malicious ideas into concrete techniques, and can independently design novel attack paths that have not yet appeared in real campaigns.
The honest context matters as much as the headline. This is a research proof of concept. Check Point found no evidence the technique is being used in real attacks, and the original DeepSeek-generated sample was incomplete and did not reliably run the full attack. A human guided every step; the AI did not launch anything on its own.
How the browser-only attack works
The technique abuses a legitimate browser feature called the File System Access API, which lets a web page read and write files in a folder you choose. The steps are simple:
- You land on a convincing web app. Check Point's decoy posed as a Discord avatar AI upscaler.
- You click to proceed, and the browser shows its normal folder-access permission prompt.
- If you grant it, the page can list the files in that folder, read and steal their contents, then encrypt and overwrite them.
- Finally it displays a ransom note demanding Bitcoin.
No native program is installed, no browser vulnerability is exploited, and no root access is needed. Everything runs inside the tab you opened.
Which browsers are exposed
The File System Access API is a Chromium feature. Check Point confirmed the risk on Chromium-based browsers, meaning Chrome and its relatives, across Windows, macOS, ChromeOS, Linux and Android, and they tested it on Chrome 148 for Android. Firefox and Safari do not expose the same file-picker method, so they are not affected in the same way. Browsers already block the most sensitive folders such as the home directory, Desktop, Documents, Downloads and system paths, though Check Point noted that Pictures and Videos were reachable on the systems they tested.
Why it was built with DeepSeek
The choice of DeepSeek is the real story for anyone watching AI safety. Check Point reported that DeepSeek's models were less consistent at refusing harmful cyber requests than models from Anthropic or OpenAI, that DeepSeek is free and widely available, and that it could often produce a working malicious app from a single broad prompt rather than forcing an attacker to split the request into innocent-looking pieces. Asked directly for ransomware, DeepSeek refused; reworded to avoid the term while keeping the function, it complied. The lesson is not that AI has gone rogue. It is that the barrier to building malware is dropping, which is exactly why defensive habits matter more, not less.
How to protect yourself
The good news is that because this attack needs your permission, you can stop it at the prompt. Check Point's advice, in plain terms:
- Treat a browser folder-access prompt like a request for admin rights. Before you allow, check which site is asking, which folder it wants, and whether it really needs to edit your files.
- Never grant a website access to folders with photos, documents, recovery codes or work files unless you deeply trust it.
- Prefer established native apps or well-known cloud services for anything valuable, not a brand-new AI tool you just discovered.
- Keep offline and cloud backups, which take the leverage out of any ransomware.
- Keep your browser and operating system updated, since vendors are refining these permission models.
- Stay sceptical of polished AI-branded utilities. A slick interface is not proof of safety.
AI-generated malware is no longer hypothetical, but the defence is old-fashioned and reassuring: think before you grant access, and keep backups. For the bigger picture of browser privacy and tracking, see our state of browser privacy in 2026.
