The PromptLocker malware, which was considered the world’s first ransomware created using artificial intelligence, turned out to be not a real attack at all, but a research project at New York University.

On August 26, ESET announced that detected the first sample of artificial intelligence integrated into ransomware. The program was called PromptLocker. However, as it turned out, it was not the case: researchers from the Tandon School of Engineering at New York University were responsible for creating this code.

The university explained that PromptLocker — is actually part of an experiment called Ransomware 3.0, which was conducted by a team from the Tandon School of Engineering. A representative of the school told the publication that a sample of the experimental code was uploaded to the VirusTotal platform for malware analysis. It was there that ESET specialists discovered it, mistaking it for a real threat.

According to ESET, the program used Lua scripts generated on the basis of strictly defined instructions. These scripts allowed the malware to scan the file system, analyze the contents, steal selected data, and perform encryption. At the same time, the sample did not implement destructive capabilities — a logical step, given that it was a controlled experiment.

Nevertheless, the malicious code did function. New York University confirmed that their AI-based simulation system was able to go through all four classic stages of a ransomware attack: mapping the system, identifying valuable files, stealing or encrypting data, and creating a ransomware message. Moreover, it was able to do this on various types of systems — from personal computers and corporate servers to industrial controllers.

Should you be concerned? Yes, but with an important caveat: there is a big difference between an academic proof-of-concept demonstration and a real attack carried out by malicious actors. However, such research can be a good opportunity for cybercriminals, as it shows not only the principle of operation but also the real costs of its implementation.

The AI news cycle of the summer captured themes including the challenge of starting a career, the importance of technology in the China/U.S. trade war, and mounting anxiety about the impact of the technology. But in terms of finance and investing, Deutsche Bank sees markets “on edge” and hoping for a soft landing amid bubble fears. In part, it blames tech CEOs for egging on the market with overpromises, leading to inflated hopes and dreams, many spurred on by tech leaders’ overpromises. It also sees a major impact from the venture capital space, boosting startups’ valuations, and from the lawyers who are very busy filing lawsuits for all kinds of AI players. It’s ugly out there. But the market is actually “more sober” in many ways than the situation from the late 1990s, the German bank argues.

Still, Wall Street is not Main Street, and Deutsche Bank notes troubling math about the data centers sprouting up on the outskirts of your town. Specifically, the bank flags a back-of-the-envelope analysis from hedge fund Praetorian Capital that suggests hyperscalers’ massive data center investments could be setting up the market for negative returns, echoing past cycles of “capital destruction.”

AI hype and market volatility

AI has captured the market’s imagination, with Cox and Abrudan noting, “it’s clear there is a lot of hype.” Web searches for AI are 10 times as high as they ever were for crypto, the bank said, citing Google Trends data, while it also finds that S&P 500 companies mentioned “AI” over 3,300 times in their earnings calls this past quarter.

Stock valuations overall have soared alongside the “Magnificent Seven” tech firms, which collectively comprise a third of the S&P 500’s market cap. (The most magnificent: Nvidia, now the world’s most valuable company at a market cap exceeding $4 trillion.) Yet Deutsche Bank points out that today’s top tech players have healthier balance sheets and more resilient business models than the high flyers of the dotcom era.

By most ratios, the bank said, valuations “still look more sober than those for hot stocks at the height of the dot-com bubble,” when the Nasdaq more than tripled in less than 18 months to March 2000, then lost 75% of its value by late 2002. By price-to-earnings ratio, Alphabet and Meta are in the mid-20x range, while Amazon and Microsoft trade in the mid-30x range. By comparison, Cisco surpassed 200x during the dotcom bubble, and even Microsoft reached 80x. Nvidia is “only” 50x, Deutsche Bank noted.

Those data centers, though

Despite the relative restraint in share prices, AI’s real risk may be lurking away from its stock-market valuations, in the economics of its infrastructure. Deutsche Bank cites a blog post by Praetorian Capital “that has been doing the rounds.” The post in “Kuppy’s Korner,” named for the fund’s CEO Harris “Kuppy” Kupperman, estimates that hyperscalers’ total data-center spending for 2025 could hit $400 billion, and the bank notes that is roughly the size of the GDP of Malaysia or Egypt. The problem, according to the hedge fund, is that the data centers will depreciate by roughly $40 billion per year, while they currently generate no more than $20 billion of annual revenue. How is that supposed to work?

“Now, remember, revenue today is running at $15 to $20 billion,” the blog post says, explaining that revenue needs to grow at least tenfold just to cover the depreciation. Even assuming future margins rise to 25%, the blog post estimates that the sector would require a stunning $160 billion in annual revenue from the AI powered by those data centers just to break even on depreciation—and nearly $480 billion to deliver a modest 20% return on invested capital. For context, even giants like Netflix and Microsoft Office 365 at their peaks brought in less than a fraction of that figure. Even at that level, “you’d need $480 billion of AI revenue to hit your target return … $480 billion is a LOT of revenue for guys like me who don’t even pay a monthly fee today for the product.” Going from $20 billion to $480 billion could take a long time, if ever, is the implication, and sometime before the big AI platforms reach those levels, their earnings, and presumably their shares, could take a hit.

Deutsche Bank itself isn’t as pessimistic. The bank notes that the data-center buildout is producing a greatly reduced cost for each use of an AI model, as startups are reaching “meaningful scale in cloud consumption.” Also, consumer AI such as ChatGPT and Gemini is growing fast, with OpenAI saying in August that ChatGPT had over 700 million weekly users, plus 5 million paying business users, up from 3 million three months earlier. The cost to query an AI model (subsidized by the venture capital sector, to be sure) has fallen by around 99.7% in the two years since the launch of ChatGPT and is still headed downward.

Echoes of prior bubbles

Praetorian Capital draws two historical parallels to the current situation: the dotcom era’s fiber buildout, which led to the bankruptcy of Global Crossing, and the more recent capital bust of shale oil. In each case, the underlying technology is real and transformative—but overzealous spending with little regard for returns could leave investors holding the bag if progress stalls.

The “arms race” mentality now gripping the hyperscalers’ massive capex buildout mirrors the capital intensity of those past crises, and as Praetorian notes, “even the MAG7 will not be immune” if shareholder patience runs out. Per Kuppy’s Korner, “the megacap tech names are forced to lever up to keep buying chips, after having outrun their own cash flows; or they give up on the arms race, writing off the past few years of capex … Like many things in finance, it’s all pretty obvious where this will end up, it’s the timing that’s the hard part.”

This cycle, Deutsche Bank argues, is being sustained by robust earnings and more conservative valuations than the dotcom era, but “periodic corrections are welcome, releasing some steam from the system and guarding against complacency.” If revenue growth fails to keep up with depreciation and replacement needs, investors may force a harsh reckoning—one characterized not by spectacular innovation but by a slow realization of negative returns.

Sevearl training events will be held for the public through the Jamestown Regional Entrepreneur Center in September.

On Sept. 9-12, a “Get Found Masterclass” will be offered to the public. This four-part workshop series is designed specifically for small business service providers who are focused on growth through smarter systems, trusted tools and clear visibility strategies. Across four focused sessions, participants will learn how to protect their brand while embracing automation, use Google’s free tools to enhance online visibility and send the right visibility signals to today’s AI-powered search engines. Participants will discover how AI can support small businesses, how to build ethical systems that scale, and what really influences trust, authority and ranking.

On Sept. 10, a stand-alone workshop on “Market and Customer Research” will be held. This workshop will guide participants on where and how to find customers. The presentation will
also discuss which SEO keywords competitors are using for free. Participants will compare current methods of social media marketing and discuss the variety of free market research tools that offer critical information on your industry and customers.

On Sept. 23, “AI tools for Social Media Marketing” is planned. Discuss the use of tools like ChatGPT to brainstorm post ideas, captions, and scripts; Lately.ai to repurpose long-form content into social media snippets; Canva + Magic Studio for fast, on-brand visuals and Metricool or later for AI-assisted scheduling and analytics. Automate so you can focus on connection and creativity.

On Sept. 24 is a high-level presentation led by Kat Steinberg, special counsel, and Amy Reischauer, deputy director of the of the Securities and Exchange Commision’s Office of the Advocate for Small Business Capital Formation, on the regulatory framework and SEC resources surrounding raising capital. They will also share broad data from their most recent annual report on what has been happening in capital raising in recent years. The office seeks to advocate and advance the interests of small businesses seeking to raise capital and the investors who support them at the SEC and in the capital markets. The office develops comprehensive educational materials and resources while actively engaging with
industry stakeholders to identify both obstacles and emerging opportunities in the capital
formation landscape. Through events like this, the office creates platforms for meaningful
dialogue, collecting valuable feedback and disseminating insights about capital-raising
pathways for small businesses from early-stage startups to established small public companies.

To register for these training events, visit www.JRECenter.com/Events. Follow the Jamestown
Regional Entrepreneur Center at Facebook.com/JRECenter, on Instagram at JRECenter and on
LinkedIn. Questions may be directed to Katherine.Roth@uj.edu.