Roblox and Open3DLab: a crawler carrying a Roblox address took 145.5 GB of 3D models, the site says, and whether it was for AI training

Roblox and Open3DLab became a Hacker News story on October 27, 2026, after the 3D-model sharing site published a post accusing a Roblox crawler of downloading 145.5 GB of its users' models without asking. The crawler's self-description, "3D foundation model research," points to the kind of generative model covered on our image and 3D models hub, and Roblox does build one. But the AI-training link is Open3DLab's inference, which the site itself says it can't prove. Roblox's response, given to several outlets, says the opposite. Sites trying to keep such crawlers out have limited tools, as our guide to detecting and blocking AI agents explains.

This story is based on Open3DLab's October 26, 2026 post, the site's robots.txt, Roblox's Cube paper and repository, Roblox's AI data-sharing documentation, and Roblox's statements as reported by RuntimeWire on October 27 and by Game Developer and CyberInsider on October 28, checked October 29, 2026.

The short version

• What the site says happened: on October 15 and 16, 2026, a crawler visited nearly every project on Open3DLab, SFMLab and SmutBase and downloaded 1,027 files from 712 projects, 145.5 GB in all.
• Why it says Roblox: the crawler's user agent named "3D foundation model research" and carried a Roblox employee's work email, which the site redacted. It ran from a single Amazon Web Services address.
• What it says was taken: 345 adult-content projects and 423 projects licensed for non-commercial use only.
• On AI training: the site calls training or evaluation data "the most likely explanation" and adds, "We can't prove it."
• Roblox's side: a spokesperson told several outlets that a researcher's agent "mistakenly scraped" the site, that it was decommissioned and that the data wasn't used for any purpose, including AI training. Roblox hasn't posted a statement on its own channels or said whether the files were deleted.

What does Open3DLab say Roblox downloaded?

According to the post, written by the site operator who signs as "Salaryman," the crawler read the main pages of 18,926 projects in 26,429 requests over 34 hours. It then downloaded complete copies of 1,027 files from 712 projects, totaling 145.5 GB. That included 364 files (54.8 GB) from 224 projects on SmutBase, which hosts only adult content. Counting SFMLab projects marked adult as well, 345 of the 712 projects (62.6 GB) were adult content, the site says, and the crawler took them at the same rate as everything else.

The post says 423 of the 712 projects carry non-commercial licenses chosen by their creators. It says the crawler fetched the site's robots.txt and ignored it, and ignored terms of service that forbid scraping. Open3DLab's robots.txt, as published on October 28, blocks about two dozen named AI crawlers from the whole site and tells all other crawlers to stay out of file-download paths. The site says the crawl saturated its free download servers for a couple of days, slowing them for other users.

How does the site link the crawler to Roblox?

Through the crawler's own label. Its user agent, as the post gives it, was trellis2-data-sourcing/1.0 (3D foundation model research; [redacted]@roblox.com). The site says the address belongs to one of the more than 40 authors of Roblox's "Cube" paper, and says it isn't suggesting that person acted alone.

The post is careful about this evidence. Anyone can write any email address into a user agent, it notes: "Still, it is a self-description, and it's the first thing we'd like Roblox to confirm." It suggests "trellis2" might refer to TRELLIS.2, Microsoft's open 3D generation model, or might be a codename, and says that model's toolkit has no crawler of its own.

The timeline the site gives: it noticed and blocked the crawler on Sunday, October 18, and emailed the address in the user agent. The crawler came back on October 19 and was blocked, made a last run on October 20 and stopped around 15:00. A second email went unanswered. Open3DLab says it has kept the relevant logs for a possible external audit.

Was it for AI training?

That is unproven. Open3DLab writes that "the most likely explanation is that the crawler was collecting training or evaluation data" for Roblox's 3D foundation model work. It also writes: "We can't prove it, and we don't know whether any of our creators' files ended up in a model."

Roblox does train 3D models, and documents some of its data. Its Cube paper, first posted to arXiv on March 19, 2025, says the shape model's tokenizer was trained on "roughly 1.5 million 3D object assets" from "a combination of licensed and public available datasets," including Objaverse, plus "the free data assets that are available in Roblox Creator Store that are opted in for training." The Cube repository says the July 2025 version, Cube 3D v0.5, "was trained on an additional ~2.8 million synthetic 3D assets." Neither mentions Open3DLab or crawling third-party sites.

Roblox's own creators face a defined policy. Its AI data-sharing documentation says sharing is on by default for items published on or after July 10, 2024, and that "free Creator Store assets are shared by default, with no ability to disable sharing." Open3DLab's creators made no such choice; the site says its downloads are free but come under the licenses each creator picked.

What has Roblox said?

Roblox has answered reporters, though not on its own channels: its newsroom had no post on the crawl as of October 29, 2026. Open3DLab's post, last updated October 26, says Roblox hadn't replied to either email.

RuntimeWire first reported the statement on October 27. On October 28, Game Developer and CyberInsider each published it as given to them directly by Roblox. In the version CyberInsider printed, the spokesperson said: "A Roblox researcher built an agent to collect publicly available 3D assets that mistakenly scraped content from Open3DLab, failing to operate as intended. The agent was decommissioned, and the data was not used for any purpose, including training any AI models." Roblox added that it is "strengthening safeguards for how agents like this are built and reviewed." None of the three outlets reports Roblox saying whether the files were deleted, which is one of six questions Open3DLab put to the company.

That account confirms the crawler was Roblox's and disputes the training inference. It doesn't explain why the crawler ignored robots.txt, whether anyone reviewed the site list, or what happens to the 145.5 GB.

The case sits inside a wider fight over how AI developers collect data, from websites closing their doors to AI agents to the Stanford Daily's report that pirated copies of Stanford professors' books were used to train Claude. Open3DLab says it separately blocked Meta's crawler after about 380,000 requests in the month before its post.

What's confirmed, reported and uncertain

• Claimed by Open3DLab, from its own logs: the dates, volumes, project counts, user agent, AWS address and email exchange. No independent party has reviewed the logs.
• Documented by Roblox: Cube's training-data description and its AI data-sharing policy for its own creators.
• Stated by Roblox to reporters: that a researcher's agent "mistakenly scraped" the site, was decommissioned, and that the data wasn't used for any purpose, per RuntimeWire (October 27), Game Developer and CyberInsider (October 28).
• Uncertain: whether the files were deleted, whether any were used in training or evaluation, and whether Roblox will answer Open3DLab's questions publicly.