2022 chat vulnerability incident

Stub

This article is a stub. You can help the Roblox Wiki by expanding it.

The 2022 chat vulnerability incident refers to the first time a long-standing oversight with the in-experience chat and moderation system was widely abused and made known to the public around July 17, 2022. The vulnerability, which has existed in theory since 2016, allows malicious developers to create experiences that spoof inappropriate chat messages from the players who join in order to get their account banned.

Incident

Background

In malicious experiences, automated messages are written and spoofed under players with the intention to violate rules and guidelines of the Roblox platform, with topics such as child abuse, racial discrimination, and criminal activity. These players are then mass reported. The moderation system believes the player sent the messages, and the player is moderated.

The theoretical exploit has existed since 2016. In November 2021, a user received a 7-day ban by the means of spoof-chatting.

Timeline

Sometime around July 17, 2022, a link to an experience began to be shared around the Roblox community, often under deceptive description of what the game was for. Players would join, and in the background, inappropriate chat messages would be spoofed while they were reported. The player would then be kicked from the experience, and then soon after find that their account had been banned. Other parts of the community would then warn against joining the experience.

Later, experiences that did not have joining third-party experiences disabled were sometimes exploited to send players to the malicious experience, along with some other malicious experiences beginning to be created for similar purposes to the main malicious experience in the incident. This caused many notable users on social media platforms such as Twitter and YouTube to warn against anyone joining any "non-trusted" experiences, or generally any smaller experience links they are sent. The main malicious experience that made the exploit commonly known was deleted sometime on July 18, 2022, but other malicious experiences were still persistent.

On July 19, 2022, Roblox engineers had acknowledged the recent exploitation of this vulnerability, and that a short-term fix would be released soon, with longer-term full fixes being worked on.