Bendy and the ink Machine Script Safety

Every loader on this wiki — Hub X, Coca Cola X pro, and the pastefy “BEST SCRIPT” line — is unofficial software that injects into the Roblox client. Roblox Terms of Use forbid that. Drecktharx did not ship these GUIs with Bendy and the ink Machine. If you run them, you are betting an account against a GitHub file and a paste site. This page is the risk list. Execute steps are on how to execute. Feature mapping is on Hub X. The loadstrings themselves stay on the Scripts Hub.

What can happen to the account

Bans. Automated detection, player reports, and video clips all land on Fighting places. A 12-player server means eleven other people can see Kill All, orbit, explosions, or a hitbox that connects through a wall. Even “quiet” ESP produces play that looks impossible: you never get flanked, you always rotate to the exact wall someone else is taking. Bans can be a warning, a few days, or the account. There is no support ticket that says “I only used Multi Gear to practice combinations.”

Cookie and session theft. A loadstring is a remote fetch. HttpGet downloads whatever that URL serves today, then loadstring runs it with the same rights as your client. If the GitHub repo or pastefy document is replaced with a logger, you still pasted the same one-liner. The logger copies .ROBLOSECURITY, can empty the account, and can hit linked games. Pastefy is worse than a raw GitHub file because you never even glance at source in the browser.

Broken sessions. After the kind of patch this place still gets (last noted 17 August 2026), tool hooks desync. You drop every wall weapon, you cannot open the backpack, or you get stuck in an orbit loop until you hard-close Roblox. That is the kindest failure mode.

Alt accounts are the only sane test bed

If you still execute:

• Create an alt that holds nothing: no Robux, no limiteds, no billing, no two-factor you care about sharing.
• Do not log the alt in a browser that also holds the main account while an executor is attached.
• Do not friend the main account from the alt in a way that makes a ban wave obvious to people who know you.
• Expect to lose the alt. That is the cost of the experiment, not a surprise.

A main account that you use for codes (when they exist), game passes, or long-term PvP reputation is the wrong place to inject Hub X.

How to look at a loadstring without trusting it

1. Read the URL. GitHub raw.githubusercontent.com at least names a user and a file. pastefy.app/.../raw is a blind fetch.
2. Open the raw file in a browser on a machine that is not logged into Roblox. If you cannot explain what the Lua does, do not run it.
3. Watch for extra HttpGet calls, request / syn.request to unknown domains, clipboard hooks, and anything that touches Roblox.Cookies or DocumentCookie.
4. If the file is obfuscated into one giant string, treat it as hostile. “BEST SCRIPT” branding plus obfuscation is a pattern, not a quality mark.
5. Re-check the raw file every session. Yesterday’s Hub X is not today’s Hub X just because the loadstring characters match.

This wiki lists circulating loaders so you can recognize them. Listing is not a security audit. We do not vouch for ADSKerOffical, pastefy, or any executor brand.

Behavior that gets you reported even on an alt

In this specific battleground, visible cheats ruin other people’s wall economy. Kill All wipes Bendy NPCs someone else was fighting. Explosion scripts (Coca Cola X pro’s pitch) turn a 12-player match into a clip. Orbiting a player off a wall is grief. Tool Control that steals every pickup is grief. If your alt exists to learn ESP timings for Beast Bendy, leave the lobby-wide buttons off. Better: learn the legal version in the Guides Hub and skip the injector.

Scripts break. Plan on it.

Executors lag behind Roblox client updates. Game scripts lag behind Drecktharx updates. Mobile APKs lag behind both. When Hub X opens a blank window, when teleports void you, when Multi Gear duplicates a tool until you crash, stop doubling down. Rejoin clean, or close the executor. Hunting “fixed” mirrors on random discords is how the cookie-logger version finds you.

If you decide the risk is not worth a slightly easier wall kit, that is the correct call. Combinations, Beast Bendy, and other players are the product. Scripts are a way to skip the product and maybe skip the account too.