Roblox-linked crawler scraped 145GB of 3D models including adult content, site operators say

What the sites say happened

According to Open3DLab, the operator of three 3D-model communities, a crawler identifying itself as Roblox property swept through its sites on 15 and 16 October 2026. The operator says the crawler viewed the pages of 18,926 projects — effectively the entire catalogue — across 26,429 requests over about 34 hours, then downloaded complete copies of 1,027 files from 712 projects, totalling 145.5 GB.

The requests carried a user agent reading "trellis2-data-sourcing/1.0" along with a roblox.com email address, and came from a single Amazon Web Services address, the operator reports. The haul included 364 files (54.8 GB) from 224 projects on SmutBase, which hosts adult content exclusively. Counting SFMLab projects flagged as adult, 345 of the 712 projects — 62.6 GB — were explicit material, and the operator says the crawler took it at the same rate as everything else.

Blocked, but it kept returning

Open3DLab says the crawler fetched its robots.txt file but did not follow it, that the sites' terms forbid scraping, and that 423 of the 712 projects are licensed by their creators for non-commercial use only. The main brake on the download volume was the speed and concurrency cap on the free download servers.

Staff noticed the activity on 18 October and blocked it that same morning, then emailed the address in the user agent. No reply came. According to the post, the crawler resumed on 19 October with every request blocked, kept attempting downloads through 20 October in a pattern that fit European office hours, and stopped by mid-afternoon. A second email also went unanswered.

Why the operator believes it was AI training

The operators label this part speculation and say they cannot prove intent. They note that Roblox has been building a 3D foundation model: Cube, its generative system for 3D and 4D, was introduced in March 2025 with a paper describing initial training on roughly 1.5 million assets from licensed and public datasets plus opt-in Creator Store items, and Roblox began rolling out 4D generation in February 2026. The email in the user agent, they add, belongs to one of that paper's 40-plus authors — while stressing that a data-collection run would be a company decision, not an individual's.

The "trellis2" name may refer to TRELLIS.2, an open 3D generation model Microsoft released in late 2025, though its published data toolkit contains no crawler, suggesting the tooling was written for this job. The sites offer what public datasets lack: complete, textured, often rigged characters in the formats artists actually work in.

Prior controversies

The post also recaps earlier criticism of Roblox: a 2021 People Make Games investigation into creator payouts, a since-settled US music publishers' lawsuit seeking at least $200 million, and Hindenburg Research's 2024 short-seller report, followed by child-safety lawsuits from several US state attorneys general. These are allegations and disputes, not findings, and they say nothing definitive about the crawler — but they frame why the operators read the incident as part of a pattern.

Why it matters

The operators are careful on one point: they do not believe Roblox deliberately collected adult content, and they have no evidence any of it reached a model. Their concern is that nobody appears to have checked — an automated system working for a platform where, by Roblox's own figures, more than a third of daily users were under 13 in 2025 pulled explicit models without distinguishing them from anything else.

Beyond that, the incident is a compact case study in AI data sourcing. A large company's crawler overrode robots.txt, site terms and individual creators' non-commercial licenses, and the company has not answered two emails asking about it. If generative 3D follows text and image models into wide use, who may harvest whose work, and on what terms, remains a question the industry has not settled.