The Hidden Circle Gazette

The 3DX Urban Legend That Turned Out to Be True

For a long time, rumours have circulated around 3DX about people being able to steal a world simply by visiting it. The story has become something of an urban legend among builders: you spend weeks or months constructing a room, open it to the public, and somewhere among the dancers, friends and random visitors is someone who can walk through the door and leave with a copy of everything you built. They don’t need you to send them the world file and they don’t need access to your computer. According to the story, merely getting inside is enough.

Recently, the question became considerably less academic. Recognisable player-created rooms began appearing on a third-party service without the permission of the people who had built them. As players compared what they were seeing, some builders recognised their own work and others reported watching additional rooms being uploaded. Inevitably, the old explanation resurfaced: someone was visiting rooms in 3DX and taking them.

Urban myth or reality? The Hidden Circle Gazette decided to find out.

Putting the rumour to the test

Rather than trying to establish what might theoretically be possible, we tested the central claim against a live installation of 3DX. We entered a room normally and then examined what was available to our game while that room was being loaded. Using tools on our computer, we were able to recover the room’s information and turn it back into a valid world file.

That confirms the important part of the old rumour, but there are also two important corrections to make. An ordinary visitor does not automatically receive a convenient world file that they can save with a mouse click, and players aren’t unknowingly accumulating copies of every room they visit. Extracting one requires deliberate action, specialised tools and enough technical knowledge to know what to look for.

More importantly, nothing happens to the builder’s computer. Calling this “hacking someone’s room” can give the misleading impression that the victim’s machine or account has somehow been compromised. In our experiment the builder’s computer was never touched. Everything happened on the visitor’s own machine, using information that their copy of 3DX had legitimately received because it needed that information to display the room.

What is actually being copied?

A 3DX world is surprisingly modest as a piece of computer data. The couches, pillars, arches, shapes and materials used by builders aren’t normally stored inside every world file; those resources are already part of 3DX. What the world contains is essentially the builder’s arrangement of those resources: which objects were used, where they were placed, how they were rotated and scaled, what colour they were given and which materials were applied to them.

A builder might spend an evening adjusting a staircase, several days creating a piece of furniture or months constructing an entire environment, yet the final result can ultimately be described as a long collection of object placements and settings. That doesn’t make the creative work less significant. A novel is also, from a computer’s perspective, merely a sequence of characters. What has value is the particular arrangement somebody created.

This also explains why the old room-theft story is plausible. When you enter another person’s world, your copy of 3DX has to recreate that arrangement on your computer. It needs to know what belongs where before it can show you the room. Whatever protection exists between the server and the client, there eventually comes a point where the game itself has to understand the information it has received.

Our test recovered the room at that point.

We won’t be publishing the tools or the practical details required to reproduce the experiment. There is a useful difference between demonstrating that a problem exists and publishing a convenient instruction manual for exploiting it. For the purposes of this article, what matters is that the central claim was tested rather than assumed, and the test succeeded.

Did 3DX simply leave everything open?

It would be tempting, having established that a room can be extracted, to conclude that 3DX simply has poor security and that the developers never made a serious attempt to protect their application. Our investigation doesn’t support that conclusion.

3DX does employ measures intended to protect its data, but those protections eventually run into a rather stubborn reality. If your computer is going to display a room, your computer eventually needs to understand what is in that room. Encryption can protect information while it travels, and keeping files out of permanent caches can stop people finding them afterwards, but neither changes what must happen while somebody is actually standing inside the world. At some point the visitor’s client has the information it needs in a usable form because otherwise it couldn’t construct the scene.

That does not make security pointless. There is an enormous difference between making a room available through a few mouse clicks and requiring somebody to possess specialised tools and technical knowledge. Barriers matter even when they aren’t perfect. What they cannot provide is an absolute guarantee that information delivered to somebody else’s computer will remain beyond the control of the person who owns that computer.

Why this suddenly matters

The Gazette began looking into this because the old rumour has collided with something considerably more tangible. Player-created rooms have recently appeared on a third-party service without the permission of at least some of their builders, prompting a lengthy discussion among people trying to determine where the worlds came from and what was happening to them.

Several participants recognised builds. At least one builder reported finding their own room among the material being published and asking for it to be removed, only for it to appear again afterwards. During the discussion, people following the service reported seeing additional rooms being added in real time, which understandably fuelled the suspicion that somebody was actively collecting worlds.

We have chosen not to identify the builders, individual rooms or the service involved. There is little value in turning affected players into unwilling participants in a public dispute, and even less in giving readers directions to a place where material may be available without its creators’ consent. The important story isn’t the name of a particular nightclub or the identity of whoever uploaded it. It is that builders have found their work being distributed somewhere they never agreed for it to be, while our investigation has independently established that one of the mechanisms long suspected by the community is genuinely possible.

When building becomes a business

There is another side to the issue that becomes easy to overlook when we talk about rooms as a hobby. Over the years, 3DX has developed its own small economy around building. Some builders take commissions, producing custom clubs, homes and other environments for customers who are willing to pay for their time and expertise. Others sell completed worlds or adapt existing designs to suit a customer’s requirements.

For those builders, an unauthorised copy is potentially more than an annoyance or an insult. Their ability to earn money depends on somebody being willing to pay for something that another person may subsequently be able to obtain without paying them at all. A customer commissioning a unique venue may also reasonably be unhappy to discover the same venue circulating elsewhere after paying for something they believed was being created specifically for them.

That doesn’t necessarily mean commercial building in 3DX is doomed. A copied world file is the finished product, but building professionally involves considerably more than possessing the finished file. A good commissioned builder is being paid for the design, the hours of work, the ability to turn a customer’s ideas into something usable, the revisions when those ideas change halfway through the job, and the experience required to solve all the little problems that occur along the way. None of those things can be extracted from a room by visiting it.

It does mean builders selling their work should think more carefully about what exactly they are promising. There is an important difference between telling a customer “I will build this exclusively for you and I won’t sell it to anybody else” and promising that nobody else will ever obtain a copy. The first is something a builder can control. Our investigation suggests the second is not.

Commercial builders would also be wise to keep records of their work. Progress screenshots, earlier versions of a build, dated files and conversations with the customer may seem unnecessary when everybody is getting along, but they provide something extremely useful if a dispute arises later: provenance. They help establish who was actually constructing the room and when.

The same applies to the terms of a commission. Does the customer receive exclusive use? Can the builder reuse parts of the design? Can the customer give the room to friends, modify it or resell it? Is the builder allowed to sell another copy? There is no single correct answer, but when real money is changing hands it is much better for both sides to agree on those things before the room is delivered rather than discover afterwards that they had completely different ideas about what “buying a room” meant.

Buyer beware

The appearance of copied rooms creates a problem for customers as well. If possessing a world file is no longer convincing evidence that somebody created it, how does a player looking to commission or buy a room know that the person taking their money has the right to sell it?

There is no perfect test, but there are sensible precautions. Buy from builders with an established reputation where possible, look at their previous work and don’t be embarrassed to ask questions about the origins of a room. Someone who genuinely built something will often have far more than the final file: screenshots taken during construction, earlier versions, portfolio posts, customers who can vouch for previous commissions or simply a history of showing their work as it developed.

Buyers should also establish exactly what they are purchasing. A custom commission is not necessarily exclusive, and a room offered cheaply to many customers is not necessarily stolen. What matters is that the seller is clear about what they created, what rights they have to it and what they are offering you.

If exclusivity matters, ask for it explicitly. If a seller says a room is unique, ask whether that means they will never sell another copy. If substantial parts of a build came from somebody else, ask whether those components were intended to be redistributed. And if somebody suddenly offers you a well-known room associated with another builder at a bargain price, a little scepticism is probably healthier than immediately reaching for your wallet.

Most importantly, buying an unauthorised copy doesn’t somehow make it legitimate. A market for stolen rooms can only exist for as long as people are prepared to obtain them. Supporting builders whose provenance you can establish is therefore not merely good manners; it helps preserve the incentive for people to continue doing commissioned work in the first place.

We’ve been here before

If all of this sounds like an unprecedented crisis created by 3DX, history offers some useful perspective. Virtual worlds have faced remarkably similar problems before, and one of the closest examples occurred almost twenty years ago.

In 2006, the creator community in Second Life was thrown into turmoil by a program called CopyBot. Second Life had already developed a substantial economy in which residents created virtual objects and sold them to other players for a currency that could ultimately be exchanged for real money. CopyBot allowed virtual objects to be copied without the original creator’s permission, immediately raising fears that merchants’ products could be duplicated and resold.

The similarities to the present 3DX discussion are difficult to miss. Linden Lab, the company behind Second Life, met with worried merchants and publicly acknowledged that creators feared their work could be duplicated by others who could then undercut them and take away their business. The reaction became serious enough that creators protested and some virtual shops closed their doors while residents demanded that the platform do something about it.

Linden Lab’s response is particularly interesting in light of what we have found in 3DX. The company did not claim it could invent a technological solution that would make copying impossible. In fact, it explicitly acknowledged the underlying problem: once information is being drawn on a user’s screen, preventing somebody from copying it completely is not realistic. Instead, unauthorised duplication using CopyBot and similar tools was declared a violation of Second Life’s Terms of Service that could result in accounts being banned. Linden Lab also proposed improving information about assets and their creators so that provenance could become part of the response.

Nearly two decades later, VRChat has encountered the modern equivalent with avatar ripping. Here again the problem involves valuable creator-made content that has to be delivered to another player’s computer before that player can see it. VRChat has continued adding technical barriers rather than claiming it can eliminate ripping completely. In 2024 it introduced stronger validation around avatar downloads, reported that many existing ripping methods consequently stopped working, and announced a ban wave affecting more than 1,900 accounts it said had used ripping tools. VRChat itself described these measures not as a silver bullet but as part of an increasingly tight collection of protections around creator content.

The lesson from both examples is not that 3DX should copy their particular technical solutions; the games and their architectures are different. The useful lesson is that other virtual worlds eventually stopped treating copying as a problem that cryptography alone was going to solve.

They combined technical barriers with rules, enforcement and ways of establishing who created something.

An urban legend with an uncomfortable answer

There are still many things we don’t know about the rooms currently being circulated. The narrower question we set out to answer, however, now has a much firmer answer.

Can somebody enter a public 3DX room and, using their own computer, recover enough information to make a complete copy of the build?

Yes. We did it.

The test required no access to the builder’s account or computer and no cooperation from the builder beyond allowing a visitor into the room. It required technical knowledge and deliberate intervention on the visitor’s side, but once that was provided we recovered a valid world.

The experience of Second Life and VRChat suggests that the most useful response is neither panic nor resignation. Builders should keep evidence of their work and be clear about what they sell. Customers should ask who created the room they are buying and what exactly their money buys them. The community can make copied rooms less valuable simply by refusing to create a market for them, while the platform itself ultimately decides through its rules and enforcement what behaviour it is prepared to tolerate.

None of that makes the underlying technical problem disappear. It does, however, recognise that the value of a commissioned room has never existed solely in possession of a file. It exists in who designed it, who paid for it, what they agreed between them and whether other people respect that work.

3DX’s building community has always operated on an implicit understanding that being invited inside somebody’s creation is not the same thing as being given ownership of it. The World Editor may reduce a magnificent build to coordinates, rotations, colours and materials, but builders don’t experience their work as a collection of numbers. They experience it as the result of evenings, weekends and sometimes months spent making something for other people to enjoy.

Being invited inside somebody’s creation is not the same thing as being given ownership of it.

Opening the door has always required a little trust. For builders who earn money from what lies behind that door, the lesson may now be to pair that trust with clear terms, good records and a little more caution about who they do business with.

— 30 —