Check Point uncovers AI‑driven in‑browser ransomware technique

Check Point Research identified a novel ransomware method that operates entirely within a web browser, using an AI‑generated code sample to combine legitimate browser APIs with malicious functions. The prototype leverages the showDirectoryPicker() API to gain user‑granted folder access, then enumerates, reads, exfiltrates and encrypts files without installing any software or exploiting a vulnerability. The researchers say the approach could lower the barrier for attackers with limited technical skill, although no active campaigns have been observed yet.

In parallel, a separate developer released AI Guard Gateway, an open‑source reverse‑proxy designed to protect exposed AI inference endpoints from hijacking, prompt‑injection and resource‑exhaustion attacks. The tool enforces authentication, rate‑limiting, policy checks via OPA and automatic redaction of PII, aiming to harden AI services against the same class of threats highlighted by the Check Point report.