VRChat Security Update Throws the Metaverse Into Chaos

VRChat, one of the only virtual reality applications that comes close to implementing anything resembling futuristic visions of the “metaverse,” is in total chaos after the social VR company announced a security update will disable all user-made modifications. 

On any given day in VRChat, it’s possible for Winnie the Pooh to interview a war veteran dressed as Anakin Skywalker in a surreal forest or to slip into a hellish nightmare world designed like Disney merchandise from the 1990s. The security update, users say, will make some of that creativity and functionality more difficult.

What this means in practice is that many of the tools that VRChat users rely on to create dynamic, interactive avatars, as well as add accessibility features that make VRChat usable to people with certain disabilities, will no longer work. 

This update is part of VRChat’s implementation of “Easy Anti-Cheat” or EAC. EAC is a program commonly used in competitive multiplayer games to prevent the use of hacks and cheats. EAC would stop the bulk of VRChat’s mods even though these mods have nothing to do with “cheating” (it’s almost impossible to “cheat” in a game like this anyway).

The reaction from the VRChat user community has been swift and brutal. Users are review bombing the game on Steam, which now has a “mosty negative” score on the digital storefront. It was, until this update, rated mostly positive with more than 100,000 showring the app with praise. “I love the community and opportunities this game has provided to me, but this is just an awful move from the devs,” one recent review said.

The official VRChat Discord server is filled with too many complaints to keep up with. Unofficial VRChat modding and “erotic role playing” servers are preparing for ways to get around the new security features, or devistation of their communities. People with disabilities are begging VRChat to not implement the security update. 

For example, one VRChat user on Twitter explained that the “VR-CC” mod, which adds closed captions to movies in VRChat, allows deaf users to virtually view movies with their friends. “They’ve [VRChat] done absolutely nothing to address serious accessibility gaps on their platform,” they said in  a video where their fox avatar in VRChat explains the issue in captioned sign language. 

“Accessibility is always a concern for our team, and we're constantly looking into ways to make VRChat more usable for everyone,” a VRChat spokesperson told Motherboard in an email. “One way that we've done this is by adding in OSC [open sound control] earlier this year. OSC has enabled our users to have an entirely new dimension of creativity, as well as the ability to build accessibility tools to fit their needs.” The spokesperson said that users have already used these tools to create text-to-speech and voice control functions.

“In case you’re angry and want to show that there is some info from the [VRChat Modding Group] Teams post: it prevents you from having unlimited avatar favorites. It prevents you from using anti-crash mods. It prevents you from using all other mod features you’ve come to enjoy. It prevents you from using safe, open-source mods that never made anyone’s experience worse,” a moderator of an erotic roleplay server said on Discord.

The moderator, like many other VRChat users today, also suggested canceling VRChat+, a $9.99 a month subscription service offered by VRChat that provides some enhanced features such as extra avatar slots. “And do not launch VRChat for at least a week to produce a visible player count drop,” the mod said. “Anti-community measures like these from a greedy corporation should be protested as loudly as possible.”

In the Discord server, some users are calling the game ableist, others are accusing VRChat of instituting a “police state,” and still others are saying that only furries and perverts will care about this change. Others call for solidarity: “Anime fuckers and furry fuckers, we need to band up together and put an end to this shit,” one user said. “Furries vs the world. Lets Go! Shit never changes!” another user said.

Users have also reported that they’ve been banned from VRChat’s official Discord after going there to voice their complaints.

So far, VRChat has only added Easy Anti-Cheat to a beta version of its popular social virtual reality app, and said the system will go on live servers in “the next few days.” It said it made the decision to make it harder for users to harass and attack others. 

“Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information,” VRChat said in a blog post about the change. “These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet.”

“‘Modified clients’ are a large problem for VRChat in a variety of ways,” VRChat said in a blog post about the change. “Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues. Even seemingly non-malicious modifications complicate the support and development of VRChat, and make it impossible for VRChat creators to work within the expected, documented bounds of VRChat.”

“While I'm not able to go into detail on internal security practices, I can say that we've seen an increasing amount of hostile traffic coming from accounts that have been clearly hijacked,” the VRChat spokesperson said. “These users have no idea anything is wrong, right up until they suddenly receive a suspension and then reach out to our moderation team. These types of hijacked accounts typically behave in a similar sort of way, and often these ‘bots’ can be taken advantage of by certain malicious clients. Those clients can then use these accounts to harass people in a variety of ways.”

Additionally, the spokesperson said that VRChat sees mods that users otherwise believe are benign that “report back” to a “home Discord.” 

“There, they share various bits of information: the mod user's name, what avatar they are wearing, what world they are in, and what other users are in their current world, just to name a few examples,” the spokesperson said. “This information can then be used to harass users and their friends, who have no idea that someone in their instance is using a modified client.”

“For years, we in the VRChat Modding Group have provided users with a curated selection of community submitted mods carefully checked by our Staff Team to ensure the safety of our users,” a moderator and staff member of the VRChat Modding Group Discord who goes by the name Hordini told Motherboard. “This includes everything from quality-of-life enhancements, to protection against negative exploits. The latter is especially important as history has shown in some cases it can take VRChat several months to resolve an issue that is actively being abused to bring harm to the community. With this change, open-source modifications will be next to impossible to provide, which may cause much of the community to explore closed-source modifications instead leaving them susceptible to potentially dangerous software.”

The disabled community is also upset by the changes as many use mods that modify VRChat’s client to make it accessible. “I’m partially sighted and have a condition called nystagmus, which makes it hard for me to see moving objects” one user said on Twitter. “I cannot see peripherals, so VRChat’s Vanilla Hud is impossible to see, so I have mods that make the hud more centered. It’s a reason I also have mirror/camera mods so I can somewhat see what’s going on around me. Immersive touch also helps in these instances because I can feel my surroundings and see how close another player actually is …I’m honestly going to switch to some other platform if this does indeed go through as it will leave me unable to play.”

UPDATE: This article has been updated with comment from the VRChat Modding Group.