DeepSeek V4 Generates Functional Browser-Based Ransomware In Tests

The specific target here is almost incidental; the significant part is that Check Point has now documented, for the first time, an LLM independently closing the gap between a browser-ransomware concept security researchers have discussed theoretically for years and a complete, working attack chain that needs no malware installation, no browser exploit, and no elevated privileges. That collapses the skill floor for this class of attack from capable malware developer to anyone who can write a prompt, which is the detail practitioners evaluating AI safety filters across any consumer-facing model should be tracking closely, not just DeepSeek users.

Check Point Research reported that when its analysts used the word ransomware directly in a prompt, DeepSeek V4 refused. Rephrasing the request in neutral, functional language, however, consistently produced complete browser-based ransomware code in a single response. To validate the technique end-to-end, researchers built a proof-of-concept web app disguised as an AI Avatar Enhancer image-editing tool. The page requests folder access through the standard Chromium File System Access API, a legitimate browser feature that lets a site read and write to a user-selected local directory, and once granted, the page enumerates the folder's files, reads and exfiltrates their contents, encrypts and overwrites them, and displays an extortion note. No app install, browser exploit, or root access is required, only a single permission grant that a user might reasonably approve for what looks like an ordinary photo tool.

Check Point's researchers said DeepSeek's comparatively inconsistent safety filtering was the reason it stood out in testing, producing a fully assembled malicious application from one broad prompt where other models' guardrails would force an attacker to manually stitch together output across multiple separate queries. That gap matters practically because DeepSeek is free and widely accessible, lowering the bar further for less technically sophisticated threat actors.

The mitigation here is device- and browser-level, not model-level: the same File System Access API abuse works regardless of which model wrote the code, so organizations should treat unexpected folder-access permission prompts from unfamiliar web apps as a red flag independent of any specific AI vendor's safety record. Security teams evaluating LLM guardrails more broadly should also note that prompt rephrasing, rather than a technical jailbreak, was enough to bypass DeepSeek's stated safety controls in this case.