Workshop Addon Safety in Garry's Mod
The Workshop is the reason Garry's Mod is still going after twenty years, and it is also the reason people ask whether it is safe. Both things are true for the same reason: an addon can ship Lua, and Lua runs. This page is about telling the ordinary case apart from the bad one, and about what to do when you have already installed something you regret.
The honest answer. The overwhelming majority of Workshop addons are fine, and the ones that are not are almost never malware in the operating-system sense. What people call a "Garry's Mod virus" is nearly always an addon doing unpleasant things inside the game: a jumpscare image, a sound at full volume, a model that follows you, a map that goes dark. Unpleasant, not dangerous to your machine. It also means the fix is to remove an addon, not to reinstall Windows.
Why reinstalling the game does not help
This catches almost everyone. Reinstalling Garry's Mod removes the game, not your subscriptions. Steam keeps those server-side, so the next time you launch, the same addon downloads again and behaves exactly as before. People reinstall, see the problem return, and conclude it is something far worse than it is.
Two places hold addon files, and they behave differently:
| Where | What lives there | What removes it |
|---|---|---|
| Steam's Workshop content folder for app 4000 | Subscribed Workshop addons, packed as .gma archives | Unsubscribing on the Workshop. It will come back if you only delete the file. |
garrysmod/addons/ | Legacy addons installed by hand, as ordinary folders | Deleting the folder. Nothing else touches these, and Steam does not know they exist. |
Garry's Mod loads every directory under addons/, whether you remember putting it there or not. A folder left behind from an old manual install is still live. That is the most common reason a problem survives a clean reinstall.
Recognising a bait upload before you subscribe
The pattern reported repeatedly in September 2026 is consistent enough to check in about ten seconds. None of these is proof on its own, but two or three together is a clear signal:
- A brand new account with no history. Level 1, no other activity, profile created around the upload date.
- Every addon uploaded on the same day. A real author accumulates work over time; a bait account publishes a batch at once.
- Misspelled names. "Nextboat" where the whole category is called Nextbot. Typos are deliberate: they dodge searches and reports while still catching people browsing.
- Trend-bait titles. Names built from whatever is popular that month, numbered in series, with nothing specific about what the addon does.
- No real description and no preview images, or preview images that do not match the title.
- A file size that makes no sense for what it claims to be. A "map pack" of a few hundred kilobytes is not a map pack.
- It claims to give you content from a game you do not own. There is no legitimate version of this. If you are missing textures, the fix is in the missing content guide, not in a pack from a stranger.
Checking subscriber counts and comments is still the best single filter. An addon with years of subscribers and an active comment thread has been looked at by thousands of people. A new upload with none has not.
Cleaning one out
- Unsubscribe first, on the Workshop itself. Deleting local files without unsubscribing just triggers a re-download.
- Restart Steam so the subscription change is actually applied.
- Look inside
garrysmod/addons/and remove anything you did not put there deliberately. This is the step people skip. - Launch with
-noaddons -noworkshopand load a stock map. If the game is clean, the cause was an addon and you have confirmed it. If it is not, you are looking at a different problem. - Re-enable your collection in groups, not one addon at a time. Halving the list each restart finds the culprit in a handful of launches instead of dozens.
- Verify the game files through Steam last, to repair the base install itself.
- Report the upload. It is the only thing that gets it removed for everyone else.
What this means if you run a server
A server owner carries more of this risk than a single player, for two reasons that are easy to miss.
Your collection is your players' subscription list. When a server points clients at a Workshop collection, every joining player downloads what is in it. A bad item in your collection reaches everyone who joins, and they will reasonably blame your server rather than the uploader.
A gamemode runs Lua on the client by design. That is not a flaw, it is how gamemodes work at all. It does mean that joining an unknown server is a bigger trust decision than subscribing to an addon, and that running a gamemode from an unknown source on your own server extends that trust to every player you invite.
Practical hygiene for a server:
- Curate the collection yourself rather than cloning someone else's, and re-check it when you add items.
- Prefer addons with a long history and visible authorship over a new upload that does the same thing.
- Keep a plain list of what is in the collection and why, so an unexplained entry is obvious.
- Test additions on a copy before they reach players.
- Take a backup of
garrysmod/before adding anything substantial, so rolling back is a restore rather than an investigation.
Since the September 2026 update, dedicated servers also clean up cache/workshop/ for addons that are no longer installed, so removing an item from a collection now actually clears its cached content rather than leaving it on disk.
What the Workshop is not
It is worth being precise, because the rumours are worse than the reality. Subscribing to an addon does not give anyone access to your files, your accounts or your hardware. The realistic worst case is an addon that behaves badly inside the game: a jumpscare, audio you did not ask for, or content you find offensive. That is a reason to curate what you install and to report bad uploads. It is not a reason to avoid the Workshop, which is most of what the game is.
Valve's own guidance on what is allowed and how to report an item is the authority on the reporting side: the Steam Workshop legal agreement.
Related Garry's Mod guides
- Missing textures and ERROR models
- Workshop collections and addons
- Workshop download troubleshooting
- Content packs and client delivery
- The September 2026 update for server owners
- Admin commands and moderation
Running a server for a group you want to keep safe? Managed Garry's Mod hosting gives you automatic backups before every change, so a bad addon is a restore rather than a rebuild.