VRChat, one of VR’s most popular social games, released an update this week has struck a nerve with its community.

The long-running social VR application, VRChat has cultivated a large community of dedicated players since its release in 2017. And while the studio behind the project has largely made steady and welcomed improvements to the platform, this week it struck a nerve with its community.

On Tuesday the studio released the VRChat ‘Security Update’ which added new anti-cheat software to prevent users from using modified versions of VRChat.

“Malicious modified clients allow users to attack and harass others, causing a huge amount of moderation issues,” the studio explained. “Even seemingly non-malicious modifications complicate the support and development of VRChat, and make it impossible for VRChat creators to work within the expected, documented bounds of VRChat.”

However, not all modified versions of VRChat are malicious; members of the app’s community say that many of them add features that make the game better, and some add accessibility options that allow users to enjoy VRChat that might not otherwise be able to. Further, some claim the anti-cheat solution being implemented (Easy Anti-cheat) will reduce the game’s performance and raises privacy concerns.

To show their disdain for the update, a vocal portion of the game’s community flocked to VRChat’s Steam store page and collectively ‘review bombed’ the title with negative reviews, reducing the app’s ‘Recent’ review score to just 18%, which Steam highlights in red as ‘Overwhelming Negative’.

Although Steam includes features designed to prevent review bombing, they don’t appear to have been triggered (though that could still happen).

In any case, the studio behind VRChat says it has heard the message from its community loud and clear.

Less than a day after the update went live, the studio updated the announcement of the VRChat ‘Security Update’ acknowledging the community’s concerns and announcing plans to pivot internal plans in order to build out some of the most-used features that were only available via modified versions of the game. However, the studio said outright that it does not plan to roll back the ‘Security Update’.

We are reprioritizing, reorganizing, and changing our internal development roadmap to focus on the feedback you’ve given us. Let’s follow that up with the hard part: we are going to be releasing this update, and we do not have plans or intent to revert or roll it back.

[…]

Addressing these concerns and feedback is our highest priority. We are changing our internal development roadmap and priorities to focus on the features and additions that you want. Currently ongoing projects are being paused, rescheduled, or re-prioritized, and resources are being re-allocated to account for this change.

In addition to the information we already had on hand, we’ve been talking to VRChat communities and community leaders about the changes and additions that they want most, including speaking to communities focused on accessibility to VRChat. We’ve also been watching and documenting constructive feedback via our typical channels like our Feedback boards, social media, and this Discord.

To what extent this announcement will appease the game’s riled community isn’t yet clear; some in the game’s community have promised to leave VRChat for other social VR platforms, leading some similar VR games, like Neos VR, to see a sudden spike in concurrent users.

Newsletter graphic

This article may contain affiliate links. If you click an affiliate link and buy a product we may receive a small commission which helps support the publication. More information.


Ben Lang
Ben is the world's most senior professional analyst solely dedicated to the XR industry, having founded Road to VR in 2011—a year before the Oculus Kickstarter sparked a resurgence that led to the modern XR landscape. He has authored more than 3,000 articles chronicling the evolution of the XR industry over more than a decade. With that unique perspective, Ben has been consistently recognized as one of the most influential voices in XR, giving keynotes and joining panel and podcast discussions at key industry events. He is a self-described "journalist and analyst, not evangelist."
  • Max-Dmg

    It’s full of children lol.

    • VRC user

      Not to mention it really shouldn’t be, VRC isn’t at all a child friendly space 70% of the time.

      • Max-Dmg

        Even when playing VR poker games, there are always children at the tables.

        • ViRGiN

          well i’m glad at least valve has a system for steamvr to group people by age!

  • MeowMix

    the studio said outright that it does not plan to roll back the ‘Security Update’.

    Good for them.

    • VRC user

      They are certainly sticking to their guns. Which is admirable. Can’t help but worry about it though. The community has said and is very vocally continuing to say we don’t want this. On a platform where everything revolves around the community, this might just hurt more than it helps.

    • Kio The Frail

      “Good for them.” oh so also good for the mute, deaf, hard of hearing, etc, people for their accessibility mods to be taken away?

      • JakeDunnegan

        Obviously, they need to fix issues for the handicapped. It will take them time to fix all VRChat’s issues, but first and foremost, client and data security need to come before handicap fixing issues.

        If the company gets sued, or other players get harmed, or doxed, that’s far more important than any group of players ability to play or not.

        • Kio The Frail

          I would agree but the security they chose doesn’t protect shit. It’s notorious for being garbage.

      • ViRGiN

        for such a massive community, why are there no open-source attempts at making the metaverse app?
        you all bought into furry/weeb monopoly, now you have to deal with the creators vision.

  • Ookami

    Might not be the exact outcome the community wanted, but I feel like this is a win. All that remains to be seen is whether the devs implement all the QoL and accessibility features that they’ve effectively removed by implementing EAC.

    • Stygian Ikazuchi

      it’s not a win. Crashers and avatar ripping are still just as rampant as ever but now we don’t have the safety mods to counteract them.

      • VRC user

        Yep. I’d even say more rampant. Retaliatory crashes have been explosively more of a problem since the announcement less than 72 hours ago.

      • Ookami

        Maybe win is too strong a term. At least the devs are letting us know that they’re listening and willing to change their priorities to meet some of the concerns. I suppose it could just be PR. Won’t really know until we get something concrete.

        • Hideki

          Technically no they’ve been saying this many times in the past and nothing ever came out of it. More than likely its just in hopes to ease the flames of the community and let the community fold on itself w/ the ” THEY SAID THEY”RE WORKING ON IT ” but the same shit for the past 6 years nearly now.

          The One dev isn’t helping their PR because he keeps adding fuel to the fire by saying things publicaly like ” you don’t need this anyways or MAYBE IF YOU GUYS HAD USED THE FEEDBACK SYSTEM IN TEH FIRST PLACE WE’D HAVE LISTENED” which after milliions had already been upvoting suggestions and ignored for years was a big F U to the populace lol they really should revoke their chat priviledges if they hope to fan these flames. The big Corp push for EAC was just totally unplanned.

          VRC ripped sites are exploding since people can now freely rip people’s avatars and crash since EAC removed people’s ability to protect themselves from it so a LOT of creators have left the platform to move to others since they’re just losing money due to this.

          Either way take what the dev’s said w/ a grain of salt given their track record of repeating history.

    • VRC user

      They certainly will. Eventually. The time is exactly the problem though. Mods that make the game accessible are available now. And unfortunately, most of the issues the community wants fixed most aren’t really touched by this new update. Bad actors can still crash other users using SDK modifications because EAC doesn’t handle those. Avatars can still be stolen without permission for the same reason. The reason a large partition of the community is upset isn’t just because we lose our oh so dear QoL features, but instead because this truly hurts more than helps.

    • DR_DDL

      Crasher Clients are already up and running though EAC like the trash anti cheat it is and there is nothing it will do to stop it just like in other video games that use EAC. It fucking lasted 2 hours without crashers clients…. and now that all the good protection clients and mods are gone there is not stopping them.

      • VRC user

        Shame that this is the unfortunate truth, part of me almost thinks that things will have to get much worse before they get much better.

      • Ookami

        I actually didn’t know there were protection mod/clients for that. I’ve never really looked into the modding scene. Didn’t really want to risk a ban.

  • kontis

    As usual, there is both, a lot of exaggerated drama and myths, but also some very valid concerns and criticism.

    – the malware problem is real and even open source programs have this issue. Also very common in Minecraft client mods. Tech support difficulty is also real and valid, however I would argue that this kind of app should treat it as necessary evil and accept the challenge, because the flexibility is incredibly important and beneficial (if not actually MUST have for metaverse-like software!).

    – The ability to crash other player’s client (or any kind of script injection) should NOT be something that has to be fixed with a 3rd party anti-cheat solution. Quite the opposite. It doesn’t make sense. This is a design issue, a serious vulnerability that no amount of band aids can truly solve. It has to be fixed by their own programmers. Something doesn’t add up here.

    – This is a sandbox social app that built its fame on openness (probably the first online “game” that allowed to officially implement your own shaders and run crazy unpredictable stuff on other users GPUs), so locking it down suddenly feels contrary to the original premise

    – the unofficial client mods ecosystem of VRChat and how many pro users relied on it shows that a proper VR social system REQUIRES a different approach compared to typical video game or even classic social network. This is actually an amazing case study that everyone looking into the “metaverse” designs should analyze thoroughly! A huge proof showing the importance of open source, open standards and interoperability of the metaverse. This isn’t some academic theoretical BS simulation. This is happening with real users in real app! Someone tell Tim Sweeny, he talked about it (and warned about similar consequences) for like a decade…

    – VRChat received around 100 million in funding. Investors demand ROI. So probably they target billions in potential revenue. This obviously skews the whole thing towards fully controlled ecosystem. That makes client mods inconvenient. Especially if they want to create virtual economy. And let’s not forget that VRChat never had dedicated servers or any kind of user-hostable servers, like Minecraft and thousands of games have (especially older ones). So there was really never a real will for a truly community-driven experience. Not giving server binaries is a red flag for any online app that pretend to be open and consumer friendly. There is like 100x bigger potential in monetization when you don’t release those.


    TL;DR I think this drama is a very valuable lesson proving that the next gen VRChat will be developed like Linux or Blender (probably also via non-profit foundation). This is the only way to do it correctly.
    But commerce shouldn’t be obstructed (like Blender does it to large extent). Artists and mod (feature) developers should be compensated for those willing to give them money for their hard work. Open source and no “one cloud” doesn’t prevent this, but makes it more complicated.

    • VRC user

      Not necessarily a correction to your post but I wanted to clarify something about your post for others. You mention ” The ability to crash other player’s client (or any kind of script injection) should NOT be something that has to be fixed with a 3rd party anti-cheat solution. Quite the opposite.” You’re absolutely correct, but this almost makes it sound like crashing clients requires something like a dll injection, and is thus prevented by EAC. This is NOT true. Crashing other clients can be done predominantly through SDK modification. As such EAC will not protect users from this most rampant problem the platform faces.

      TLDR. EAC, even when not circumvented, will not prevent crashers and avatar rippers

  • Andrew Jakobs

    “and collectively ‘review bombed’ the title with negative reviews, ”
    And that’s why they should ban these people… I really hate it when people gonna reviewbomb because of something other than the actual application/game itself. If accessibility mods/versions are great and do no harm, why not work with the developer to get those into the official game.
    But there are too many crybabies these days, if they don’t get it their way they start crying and acting all up.

    • VRC user

      Mod authors have been begging to do exactly that for ages, the developer has shown no interest, just check their public discord for proof. VRChat has said time and time again that all mods are against TOS. This was them enforcing that rule in the quickest and most effective way possible, which is absolutely understandable. But in doing so, a lot of users who NEED those mods to play the game are cut off entirely. This is what a large portion of the users are really upset about, as vrc has become a sort of collective platform where people can express themselves as they like, it became increasingly important to the community to be accessible. Without these mods it isn’t.

    • VRC user

      As a quick side note, I absolutely agree there’s way to many “crybabies”. Thing would be handled much smoother if people handled these matters in a mature way. Still though, I suppose it accentuates the impact this change is actually having, and will likely continue to have.

      • Alexisms

        Also review bombing helps get notice out there to the wider community that there is something seriously wrong. Without that would we even be discussing it here?

        • VRC user

          Another notable point. Perhaps “review bomb” isn’t quite the best phrasing for what is going on, as there is certainly valid points from a number of perspectives.

    • Kio The Frail

      Would you rather they continue doxxing people? also “If accessibility mods/versions are great and do no harm, why not work with the developer to get those into the official game.” wow jeez if they could’ve done that i think they would have but the devs don’t give a single shit

    • ViRGiN

      Single player one of the best ever to date vr games both by sales and playercount, superhot, rolled out an update that deletes scenes where to continue forward you have to shoot yourself in the head.

      How are you going to explain that? Download an old cracked version to enjoy the game in original state that existed for years with no updates. It all happened because of some family drama involving one of the developers. So to heal his pain, he prevented everyone from ever commiting vr suicide ever again.

      • Ookami

        uh… what are you even talking about? This thread is about VRChat. You sure you posting in the right place?

    • Quick Take

      While I often agree with many of your takes, wouldn’t this be the perfect time and a valid excuse to “review bomb”? VRC is having a fundamental change to its base game and reviews from before this change no longer reflect what they are reviewing. So if the ACTUAL game transitioned to something the users don’t like, they should be able to change their review. I don’t like review bombing due to something said or some drama but changing reviews after an update to the game is how it should be. Take No Man Sky, where the game today doesn’t reflect the game at launch and reviews should change so that shoppers now have a more accurate rating of what they are about to get into.

    • Tabp

      Their negative reviews are about the actual application itself. You are lying and trying to cover up the game’s serious flaws by attacking messengers on false pretenses.

      Many mod creators did attempt to work with the developers, and the developers rejected the community’s offers of cooperation.

      Very ironic to see you calling for bans against people who are making legitimate complaints about the core functionality of the game. You are the crybaby here.

  • withoutAfaceAsingleWord

    Given how quickly the rollout occurred I’m betting they found a major vuln that was either actively being exploited or could easily be exploited, and realized their code-base (something everyone acknowledges) was probably not designed well from the start, and needed an immediate solution. Enter EAC for at least some protection while they refactor code etc.

    My bet is they’d like to have mods that are signed/whitelisted at some point via a fairly locked sandbox, but that it’ll take a fairly length rewrite to get there.

  • Joe “cyb3rofficial” Koen Ⓜ

    EAC is the same as keeping your front door open, letting unkown people watch you. Also leaving high chance of people getting in. EAC is only a burden on the end user.

  • Ad

    This doesn’t count as a review bomb, that system is for unrelated or off topic reasons (Ukraine-Russia, anti-feminist panics, etc), not for something inside the game that affects its quality or functionality.

    • ViRGiN

      you gave valve the power to deem review ‘a bombing’ if it hurts their wallets.
      you were the one spreading ‘buy it on steam’ propaganda for years.

  • Axeius

    kontjs post very informative and vrchat cant just fix anything cus if theres someone angry and mean and so so rude and insecure they are determined to ruin other people’s day, they will do it for some reason that no one knows.

  • 3DHeinz

    An ultimate link of the list of good/ beyond/ bad mods would help a lot to understand the crux of prevent all of this.

  • So many dudes in drag….

  • It’s about time they did SOMETHING. I can’t count the number of chatrooms blasted with hardcore porn by some prick from Russia had a bad day and wanted to take it out on everybody else.

  • Jason Redmon

    Why would Steam have measures in place for ‘review bombing’?
    If that many people don’t like it, they don’t like it. All this censorship is getting real old and I don’t need Steam telling me what I can and can’t vote down, like Youtube does.

    • Aqua

      Steam has “review bombing” measures in place for when it’s *actually* review bombing. An influx of negative reviews by itself isn’t a review bomb, an influx of negative reviews from a source that is *not that game*, more often than not, is a review bomb.

      The best example of this is the Epic Games Store. When fans of the Borderlands series found out that there would be a 1-year waiting period for Borderlands 3 to come out on Steam after it was released on EGS, they were upset. So they went to the store page of one the earlier games, Borderlands 2, and left negative reviews. The reviews never talked about the game that they were leaving the review on, and instead talked about the business practice of the NEXT game coming out. Might be the same franchise, sure, but it had absolutely nothing to do with the game itself. Thus, Steam marks it and tells people.

      If you check the store page, Steam doesn’t mark this recent outpour of negative reviews as a review bomb, because it’s what is happening to VRChat *right now*, and is directly involved in VRChat. It would be a review bomb if it was getting these negative reviews from some other game they created.

  • Keglanek

    Give it a month, once the outrage dies down everyone will be back on VRChat.

  • D Zero

    Maybe they should have ALREADY been adding what their players wanted. It’s pretty amazing to me that they weren’t already looking at what mods were there and intending to add the important ones as features. Seems like something you should do BEFORE removing mod support.