I wanted to bring this to your attention because it seems like there might be a serious vulnerability in how Roblox’s automated systems handle avatar detections, especially with the new AI stuff they’re using for moderation. My friend had his main account (username: IMWAYTOORICHFORTHIS) hit with a 7 day ban earlier today for “terrorism/extremism,” and the violation screenshot shows an avatar dressed in what looks like KKK-inspired gear a white robe, pointy hat, red cross on the chest.
The thing is, he never wore anything like that, doesn’t own any of those assets, and has no idea how it got associated with his account.
This seems like a new exploit bad actors are using to target users in order to get them banned.
I am not sure if this was done through a crossroad’s style game or simply another exploit. But we have no Idea where this humanoid description came from.
Expected behavior
Not falsely terminated over something you do not own maybe.
Don’t use AI when you are not certain about their avatar or just straight up be able to verify the real avatar.
Automated moderation should not be allowed to reevaluate your punishment after an appeal to make it worse
Also my friends told me that their accounts got deleted over the same avatar(they never worn it)
I think there’s some exploit that change someone other avatar ingame.
One of my friends also was affected by this exploit/vulnerability
It was originally a termination and then a 7 day ban but Roblox support isn’t responding at all, please look into this because they are still terminating people in the past day so getting this fixed fast will help a lot of people.
Considering this was done on inactive accounts such as infamous exposed users such as Nathorix which have been inactive for years and years, this isn’t connected to games to my knowledge.
My friend @StealthSoul was also affected by this termination exploit. He told me his account was terminated as a result of this. The same picture that was attached by the original poster can be seen in the report-appeals page.
This is clearly an exploit as my friend did not own any of the items it showed him wearing & he is not a racist or terrorist.
Unfortunately the robot did not believe his innocence and refused to revoke the termination. This is a huge bug and can be used to target any user. My friend told me the last time he logged into the account was months ago which makes this a 0 click exploit. The user doesn’t even have to be logged in to be terminated by this. It is an extremely dangerous vulnerability that needs fixing as soon as possible.
I think I know how they’re doing this, an exploiter uses this avatar and when they join your game it obviously inserts THEIR HumanoidDescription into the game which they then report your game for including and you get punished for
Roblox doesn’t use AI for appeals. You can see this both in the post on Roblox’s Newsroom, where they explain it with visuals and in detail, and also directly in the “Decision” section of moderation messages where a 7-day ban gets converted into a termination after an appeal.
If the decision says “We used automated systems to detect this violation.” it means the AI detected the rule violation but the action was taken by a human. However, if it says “We used automated systems to detect this violation and make this decision.” then it means both the detection and the enforcement were handled by AI.
So yeah, a human also thinks this was a policy violation, and they’re right. I just hope the root cause gets identified soon and that the person with the actually problematic avatar gets punished, so that Roblox stops penalizing creators because of some random player’s malicious intent.
From most of the screenshots shared above, what I’ve observed is that the long identifier that shows up after “humanoidDescriptions/” is the same in everyone’s moderated asset section. I honestly can’t understand why Roblox either can’t detect when it’s a repeated pattern being abused or can’t determine whether the creator is actually at fault, it’s mind-boggling.
Another report spoofing vulnerability.. Basically, the reporting system is not verifying the actual avatar data from Roblox’s backend and instead is allowing the report (with injected/altered asset IDs or description text) and lets attackers falsify evidence (e.g. making it look like a user wore a kkk outfit) and trigger bans by automated moderation without the target ever equipping those items. Instead of reporting this to hackerone they decide to abuse this stupidly.. Hope everyone get’s their accounts back soon.
