Google opens beta for AI ransomware detection in Drive for desktop

Google is adding an AI powered ransomware detection feature to Drive for desktop on macOS and Windows that will pause syncing and offer quick file restoration when the service detects mass file encryption or corruption. The feature, which Google says is entering an open beta starting today, is intended to prevent compromised files on a device from overwriting clean copies stored in Drive and to speed recovery for individual users and organizations.

The detection system uses a specialized AI model trained on millions of real world ransomware samples and continuously incorporates new threat intelligence from VirusTotal. Rather than searching for malicious code signatures, the model monitors patterns of file changes and looks for behavior that typically signals ransomware, such as rapid bulk encryption. When the model identifies unusual activity, Drive automatically pauses syncing of affected files, sends a prominent desktop notification and an email alert, and notifies IT administrators in managed environments. Users can then restore files to a prior healthy version through a web interface Google provides after removing the ransomware from their device and deleting corrupted files.