Roblox AI Agent Downloaded 145 GB of Other People's 3D Models

Roblox Corporation has confirmed that one of its AI agents siphoned 145.5 GB of other people's 3D assets from the Open3DLab library and its affiliated sites SFMLab and SmutBase. The company stated that the agent was not operating as intended, that it had been taken out of service, and that the collected data was not used for any purpose, including model training.

For 3D artists, the crawler's sequence of actions is telling in itself: it first requested robots.txt — and ignored the instructions in it. Next it violated the site's terms of use, which expressly prohibit scraping, and the authors' non-commercial licenses. The familiar mechanisms that creators use to shield their work from being harvested into training datasets did not stop it at a single step.

How the site detected the crawler

The activity was tracked by an Open3DLab administrator going by the handle Salaryman. According to his data, the bot went through nearly all the projects on the three sites and downloaded 1,027 files from 712 projects. These are works by community members — 3D artists and creators who build scenes in Valve's Source Filmmaker and use SmutBase and SFMLab as dedicated resources for 18+ material. Adult content accounted for 117.4 GB of the total volume.

The operators noticed the crawler on 18 October, blocked its requests and wrote to the person responsible at an address found in the agent's data. The next day the collection resumed, bypassing attempts to halt it. The administrators linked the bot to a Roblox Corporation researcher — one of the authors of the paper describing Cube, the company's foundational generative system for 3D. Other markers in the agent's data indicated that it was collecting models for a training dataset.

A separate set of grievances concerns licensing. Many models are posted under non-commercial terms, and some are built on other parties' intellectual property: among the downloads Salaryman names Eve from Shift Up's Stellar Blade and Mei from Blizzard Entertainment's Overwatch. These files ended up in the haul alongside everything else.

Why adult content in the dataset is critical for Roblox

Before the company responded, Salaryman framed the risk this way: if such data reaches a model that generates assets for Roblox, the only barrier between it and a child audience will be a filter bolted on after the fact.

"Models reproduce what they have learned. If adult data gets into a model that generates assets for Roblox, the only thing separating that data from children is the filter Roblox builds afterwards, because nothing was filtered at the collection stage"

A side effect of such a scenario: users who generated an asset like that with the platform's own built-in AI tools would find themselves in breach of its own rules. Salaryman stresses that he does not believe anyone deliberately set out to collect adult content, and that is precisely what worries him: judging by the logs, nobody was checking where the crawler was pointed or what it was taking.

The complaint lands against a long-running backdrop: Roblox has been criticised for its moderation of sexualised content and for how the platform is used by bad actors targeting minors. In 2026 the company tightened moderation — by the assessment of investment research firm Bleecker Street Research, to the point that it hurt audience growth. At the same time the company remains entangled in proceedings with government bodies and with parents of affected minors; it denies the accusations. Roblox head David Baszucki has already drawn criticism for how he answered journalists' questions about child safety.

What the company promises to change

Roblox's statement says the agent has been shut off, the data was not applied to any tasks, and that the company is strengthening — and will continue to strengthen — its approaches to building and reviewing agents of this kind "as the agentic systems landscape evolves". The details of those procedures — who signs off on data sources for internal crawlers, and at what stage — are not disclosed in the statement.

The race for 3D data has run up against other people's libraries

This case looks like a symptom of a broader process. Generative models for 3D require large volumes of training data, and openly available 3D assets are markedly scarcer than pictures and texts. Against that backdrop, large platforms building their own foundational models for geometry are probably looking more and more often toward fan-made and specialist libraries, where finished meshes, rigs and textures have accumulated over years. Such collection is handed off to autonomous agents, and unlike a classic crawler with an explicitly specified list of domains, they find it easier to wander off to places they were not invited.

For creators, the unpleasant conclusion follows: robots.txt and a line in the terms of use remain an agreement held together by good faith, and the party expected to honour it is the one that stands to gain from breaking it. Sites hosting user 3D work will probably respond with technical measures — hard authentication, download rate limits, the removal of direct file links — and that will make life less convenient first and foremost for well-behaved visitors. If the story repeats at other companies, the next step may no longer be letters from administrators but legal claims from creators and from the rights holders of the characters whose models end up in the hauls.

Open3DLab noted separately that it supports adult content — it is the foundation of their sites. What they object to is their sites being swept into someone else's training dataset without asking, and the result potentially ending up in tools used by children.

What is this incident connected to: the unchecked autonomy of agents, the race for 3D-generation data, indifference to robots.txt?