There is a critical bug in both Roblox Studio and in-game environments where scripts can be inserted inside of deprecated or internal instances—such as ChannelSelectorSoundEffect—via .rbxm or .rbxmx files. Once inserted, these scripts are undetectable via normal Lua methods such as :GetDescendants(), FindFirstChildWhichIsA(“Script”, true), or even FindFirstChild(). They also evade detection by virus scanner plugins and cannot be accessed via the command bar.
In the specific case of HumanoidDescription, if a script is parented to this instance, it is invisible to these search methods despite still being visible in the Explorer window. Even with deep scanning functions or plugin tools, these scripts return no results, making it possible to hide backdoors in plain sight without triggering any standard detection mechanism.
This can lead to serious security issues where malicious scripts are bundled inside assets or models and shared on the Creator Marketplace undetected. Plugins like these fail to find the hidden scripts:
RBXM Virus Scanner Plugin
Ro-Defender
The only way these scripts can be seen is by manually expanding the affected instances in the Explorer window. This also affects other deprecated or internal instances (e.g., ChannelSelectorSoundEffect) which cannot be created through Instance.new() but may still exist in legacy or modified model files.
Steps to Reproduce:
Insert a script into a deprecated/non-existent instance.
Attempt to locate the script using code:
for _, obj in pairs(ChannelSelectorSoundEffect:GetDescendants()) do
print(obj.Name) – Returns nothing
end
Use plugins or command bar scanning scripts — no results are found.
Open the Explorer and manually check — the script is present inside the instance.
Expected behavior
Either make it so deprecated or non-existent instances are automatically deleted. Or make it so roblox scripts can get the descendants/children/etc inside the instance.