R
Detected
Real
100% sUNC, 99% UNC, free, Detected. Three tracker facts and several explicit unknowns.
record · checked 2026-10-21
100% coverage. Detected. Documented delivery.
The tracker says the functions work. The forum post says the anti-cheat recognizes it. The GitBook says how to get the file. None of those statements answers the same question.
sUNC100%
DetectionDetected
Version1.733
DeliveryDiscord bot
01
What the tracker records
ScriptBunker's last synced status for Cosmic is October 14, 2026, 18:15 UTC. The page marks the status as "Updating / Outdated" and notes that live status is temporarily unavailable . The recorded values are version 1.733, sUNC 100%, UNC 99%, decompiler available, and Detected.
ScriptBunker adds its standard caveat: "Not marked detected" is not a guarantee of safety, and ScriptBunker does not verify it . The same caveat applies to the Detected flag in reverse. It is a third-party signal, not an audit.
02
What the DevForum post documents
A post on the Roblox Developer Forum describes a detection method for Cosmic using debug.traceback. The author writes that when Cosmic is injected, the traceback size is 0, and that this can be checked in a loop:
if (#debug.traceback() == 0 or debug.info(2, "f") ~= error) then print("cosmic?? lol???")
The same post calls the executor "vibecoded," says its UI is "literally Synapse-X V2's UI," and predicts the executor will be "plagued by RCE" due to what the author describes as incompetence. The author also notes Cosmic is being rewritten, and that the detection will likely be patched when the rewrite is complete .
This is a forum post, not a security audit. It is one developer's detection method and opinion. It is useful because it is a specific, testable claim from someone outside the executor's ecosystem.
03
What the GitBook documents
The GitBook page for Cosmic is a delivery manual, not a product description. It documents the /register command for account creation, the /changelogs command for updates, and the /download command for retrieving the file . It also documents troubleshooting: /resetpassword and /resethwid for injection crashes, /resetemail for login errors, and /subscription for checking username status .
A separate troubleshooting page lists specific error codes: 0x2 for HWID creation failure, 0x6 for authentication rejection, 0x12 for a tampered connection to auth.cosmic.best, and 0x13 for missing or corrupted credentials . It also offers a direct download link to a .rar file hosted on catbox.moe .
The GitBook is thorough. It is also entirely written by the project. It documents how to get and run the file. It does not document what the file does.
04
The three sources, read separately
ScriptBunker tells you what functions exist and what the anti-cheat thinks. It does not tell you what is in the loader. The DevForum post tells you one developer found a detection method. It does not tell you whether the detection is current or whether the rewrite patched it. The GitBook tells you how to obtain and troubleshoot the file. It does not tell you whether the file is safe.
A user who reads only the GitBook knows how to install Cosmic. A user who reads only the tracker knows the function score. A user who reads only the forum post knows someone called it "vibecoded." None of those three readings is complete on its own.
Sources: ScriptBunker Cosmic · Roblox Developer Forum thread · GitBook delivery manual . The DevForum post is a forum comment, not an audit.
Why the DevForum post matters more than the tracker score
A 100% sUNC score tells you the executor implements every standard function. It does not tell you whether the anti-cheat can see it. The DevForum post tells you that at least one developer found a way to see it, using a specific method that relies on a property of Cosmic's injection process .
The post is not authoritative. It is a forum comment, written in a dismissive tone, by someone who is clearly hostile to the executor. But it contains a testable claim: that debug.traceback() returns a zero-length string when Cosmic is injected. That claim can be checked. The tone cannot.
The post also says Cosmic is being rewritten and the detection will likely be patched . If that is true, the detection method described in March 2026 may not work in October 2026. The tracker's "Detected" flag suggests the anti-cheat still recognizes the executor in some way, but it does not say which method.
Why the GitBook is not a verification source
The GitBook documents every step of the delivery process: register, download, unpack, reset HWID, troubleshoot error codes. It is a thorough manual. It is also entirely controlled by the project. A manual can describe how to obtain a file without describing what the file contains.
The direct download link to files.catbox.moe is worth noting. A .rar file on a third-party file host is not a signed release, not a public repository, and not a hash-verified artifact. It is a file you download from a link. The GitBook tells you to trust the link because the GitBook says so.
The record, with its gaps marked
| Attribute | Value | Source | Confidence |
|---|---|---|---|
| Version | 1.733 | ScriptBunker | Recorded |
| sUNC | 100% | ScriptBunker | Recorded |
| Detection | Detected | ScriptBunker | Recorded |
| Detection method | debug.traceback | DevForum | Forum claim |
| Delivery | /download, .rar | GitBook | Project docs |
| Sandbox score | Not found | — | Unknown |
| Domain reputation | Not found | — | Unknown |
"Forum claim" means the information comes from a forum post, not an audit. "Unknown" means no source was found at review time.
What this page does not claim
- This page does not claim Cosmic is malware. The DevForum post is hostile but does not present a malware analysis. It presents a detection method.
- This page does not claim the DevForum detection method still works. The post itself says Cosmic is being rewritten and the detection will likely be patched .
- This page does not claim the GitBook's direct
.rarlink is safe. It documents that the link exists. It does not audit the file behind it.
Cosmic questions, separated from the project's own manual
Is the DevForum post a reliable source?
It is a forum comment, not an audit. The author is clearly hostile, calls the executor "vibecoded," and predicts RCE . But the post contains a specific, testable claim about debug.traceback returning a zero-length string. The claim can be checked independently. The tone cannot be treated as evidence.
What does "Updating / Outdated" mean on ScriptBunker?
It means the tracker's last synced status is from October 14, 2026, and live status is temporarily unavailable . The recorded values are the last known state, not a live reading. The version and detection flag may have changed since then.
Why is Cosmic delivered through a Discord bot and a .rar link?
The GitBook documents a /download command on Discord and also provides a direct .rar link hosted on catbox.moe . Neither is a signed release or a public repository. Both are delivery mechanisms controlled by the project.
Does 100% sUNC mean Cosmic is undetected?
No. ScriptBunker records Cosmic as Detected . The sUNC score measures function coverage. The detection flag measures whether the anti-cheat recognizes the executor. The DevForum post describes one method the anti-cheat can use to recognize it.
Can I download Cosmic from this page?
Not yet. The Download button is a placeholder. When you have a confirmed source and choose to link it, replace the href. Until then, this page serves no file.
Why does this page look different from Real's?
Because the evidence is thicker but less certain. Real had three tracker facts and several explicit unknowns. Cosmic has three sources that describe three different things: a tracker, a forum post with a detection method, and a project manual. The layout uses a spacious hero and vertical sections because the evidence needs room to be separated, not compressed.