I’m currently trying hard to patch an issue on my game (https://www.roblox.com/games/2001392169/Disneyland-Robloxia).
I’m unaware of how this is being injected in to the game.
This seems to be what they load up: 
Anyone know how I would go about fixing it?
The hack allows them to hint, message, spawn gear (including Roblox’s old building tools), change the Skybox and change players to inappropriate photos.
Filtering Enabled is on.
The way I’d go about patching an exploit is either listen to any child that gets added to the player’s PlayerGui on the client and check the name (that’s, of course, if you know the exploit’s gui name). However, if you don’t know the name of the gui, but know some text that usually shows (say something like that title: “SirHurt ServerSide”), you can loop through the descendants (mainly text labels) of the gui (child) that was added to the PlayerGui and check the text, if it matches the exploit title text label, remove the gui and kick the player, perhaps ban them.
But that’s just my way. There are more efficient ways.
For a temporary fix, I think that’ll be the easiest option to make.
Thanks 
I’d recommend you to search all your scripts (ctrl + shift + f) for “require”, if you find any suspicious script, delete it, check all your plugins as well, make sure that the “real” creator made them.
Looks like you downloaded a malicious plugin. I’d double-check all of your plugins’ legitimacy.
We now understand the issue was InsertService and was naming the scripts random names (4 digit numbers).
They’ve been removed for now.