Game Developers on Steam Denounce Exploit Claims as ‘Exaggerated Clickbait’ and ‘Malicious Defamation’

The team behind the popular open-source MMO RTS sandbox game for coding fans, Screeps: World, has had to roll out an update to safeguard both players and their own reputation after a serious remote code execution vulnerability was uncovered. This flaw could potentially allow players to gain control over others’ computers. Compounding the issue, the individual who identified the vulnerability claims that Valve overlooked their report.

The situation escalated into a heated exchange on social media between Screeps, LLC, the developers of Screeps: World, and Isaac King, a self-proclaimed information security expert.

King’s initial post revealed that Screeps: World had a flaw that permitted any player in the game to remotely access another player’s computer via a programming exploit. For those unfamiliar, Screeps: World is a unique programming game where players write JavaScript code to create custom AI units.

As of now, the game boasts a “Very Positive” rating on Steam, with around 1,876 reviews and over 113,000 purchases, according to VG Insights.

For a deeper dive into the specifics of the vulnerability, King has provided a comprehensive write-up on his blog, though it does require a basic understanding of JavaScript to fully grasp. He also offers a relatable analogy for non-programmers: “imagine if there were one particular kind of unit in Starcraft that, if you trained it, let people hack your computer. And when pointed out, the game designers said ‘well this is self-inflicted, the players all chose to train that unit.’”

King further noted that the developers had been aware of the issue since July 2024, as one of Screeps, LLC’s developers responded to a GitHub report about the vulnerability, downplaying it as a serious security threat. However, a user on the Screeps Discord mentioned that the vulnerability had been exploited in the past.

As the initial post gained traction, the official Screeps account on social media responded, labeling the accusation as “at the very least, a clickbait exaggeration, and at worst, malicious defamation intended to cause reputational damage.” Nonetheless, they confirmed that the alleged vulnerability was removed from Screeps: World as of January 25.

In a more concerning note, King mentioned in his blog that he had reported the issue directly to Steam but received no response: “I reported the game to Steam, which of course they ignored. Their terms of service make them not liable for any hacks caused by malware on the platform, so if it’s getting sales from which they can take a cut, why do anything about it?”

We’ve reached out to Valve for confirmation and will provide updates if they respond.