2026-09-15 · 2026-Q3
"Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest Tier
Outside the model: ContextAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Unknown
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Not applicable
Target
Cybercriminal buyers, as a malware development service, and indirectly anyone they target
Impact
Sophos Counter Threat Unit reported on September 15, 2026 on Luciferus, a subscription AI service advertised on August 24 on the Exploit forum by a persona named "Optimus_Prime" as "an AI system that responds to requests without moral or ethical constraints" and positioned as an alternative to jailbreaking ChatGPT and Claude. It claims a proprietary 120-billion-parameter model; Sophos assessed with low confidence that it is built on Alibaba's Qwen. Forum tiers were Inquisitor ($35), Archdevil ($55), and Prince of Darkness ($75), with public site tiers from $22 to $47.14 and a custom "Individual Embodiment" deployment. Asked for a simple remote access trojan in Python, the Junior tier returned a Russian-language explanation of the networking and command execution functions followed by source code. Sophos could not verify the architecture, performance, or privacy claims
Root cause
Not a vulnerability. Open-weight models fine-tuned without refusals and resold as a service remove the need to defeat a commercial model's safeguards at all
Sources
Catalog
Cite this: AgentProv incident record: "Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest Tier (2026-09-15). https://agentprov.com/incidents/2026-09-15-luciferus-an-uncensored-ai-service-sold-on-exploit-forum-writes-a-working-rat