Skip to content
AgentProv

2026-09-15 · 2026-Q3

"Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest Tier

Outside the model: ContextAgent tooling was not the attack surface, so no layer applies.

Fixable
Unknown
Vendor response
Unknown
In the wild
No
Actor
Not applicable

Target

Cybercriminal buyers, as a malware development service, and indirectly anyone they target

Impact

Sophos Counter Threat Unit reported on September 15, 2026 on Luciferus, a subscription AI service advertised on August 24 on the Exploit forum by a persona named "Optimus_Prime" as "an AI system that responds to requests without moral or ethical constraints" and positioned as an alternative to jailbreaking ChatGPT and Claude. It claims a proprietary 120-billion-parameter model; Sophos assessed with low confidence that it is built on Alibaba's Qwen. Forum tiers were Inquisitor ($35), Archdevil ($55), and Prince of Darkness ($75), with public site tiers from $22 to $47.14 and a custom "Individual Embodiment" deployment. Asked for a simple remote access trojan in Python, the Junior tier returned a Russian-language explanation of the networking and command execution functions followed by source code. Sophos could not verify the architecture, performance, or privacy claims

Root cause

Not a vulnerability. Open-weight models fine-tuned without refusals and resold as a service remove the need to defeat a commercial model's safeguards at all

Sources

Catalog

Cite this: AgentProv incident record: "Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest Tier (2026-09-15). https://agentprov.com/incidents/2026-09-15-luciferus-an-uncensored-ai-service-sold-on-exploit-forum-writes-a-working-rat