What changed

Roblox's script sandboxing is now on for every model inserted into BIRD. The main thing this does is block external code from loading at runtime, which means our systems and moderators can review 100% of the code that runs in BIRD. Some Roblox features are also blocked to keep players safe.

What's blocked

These capabilities are not in the allow list, so any script that tries to use them will fail:

  • HttpService — no fetching from external URLs
  • TeleportService — no teleporting players to other places
  • loadstring — no compiling and running code from a string at runtime
  • require(<assetId>) — no loading other Roblox assets at runtime by ID
  • MarketplaceService:PromptPurchase and friends — no charging users for things outside the BIRD payout system
  • A few internal APIs that game scripts shouldn't touch (plugin APIs, capability control, the avatar editor, etc.)

When a script tries something blocked, you'll see a Roblox error like:

The current thread cannot require using asset ID (lacking capability LoadUnownedAsset)
Stack Begin
    Script 'Workspace.SandboxedModel.Giant Milk.Milk Carton.CoreViewSystem', Line 261
Stack End

The capability name in the parentheses tells you which permission the script needed.

What still works

Almost everything else. The one worth calling out specifically: DataStores still work — they're in the allow list, so your saves and persistence keep working as before. If your model is written like a normal Roblox script, it almost certainly still works exactly the same.

In practice, sandboxing intercepts around 60 blocked API calls per day across live BIRD servers — about one every 25 minutes, with roughly two-thirds being attempts to fetch external Roblox code at runtime (the require(<assetId>) pattern). Most of these aren't intentional: creators often paste code from other free models, and that copied code can call APIs we don't allow without the original creator ever noticing. Sandboxing surfaces those behaviors safely instead of letting them run silently.

Test before you publish

The Model Examples place has been updated to apply the same sandbox to its workspace as BIRD does. If your model's scripts hit a blocked capability, you'll see the error there when you test — much easier than discovering it after publishing.

If something broke

If your model stopped working since this rolled out, please reach out in Discord. Tell us the model name and what behavior you noticed. We'll help figure out whether it's a sandboxing block, an unrelated bug, or something we can patch around.