Despite making changes last fall to help block adults from messaging unknown children, Roblox is still failing to stop adults from creeping on kids in other ways, Australia’s eSafety commissioner, Julie Inman Grant, said on Thursday.

Suspecting that Roblox may not be doing enough to stop child exploitation, eSafety conducted testing earlier this year that flagged alarming gaps in Roblox safeguards. The agency found that adult strangers could still send connection requests to kids, whose “profiles and biographies, including account names, number and names of connections, avatar images, and non-sensitive biographical information such as their interests were visible to anyone on the Roblox platform, with no option to restrict the visibility of this information.”

Such requests did not trigger parental alerts, eSafety found, and bad actors could also search kids’ visible-to-anyone contact lists for more targets.

Perhaps even more concerning, adults could also search for kids and comment on their posts “without parental or carer consent” in “forums outside game environments,” eSafety said.

Australia’s Online Safety Act requires that platforms prevent unwanted contact between adults and minors. It also mandates setting children’s accounts to private by default. Although Roblox “believes it is meeting its obligations,” the online gaming platform—which 1.7 million Australian kids use—has entered a court-enforceable agreement to make changes in the next three months.

Upcoming measures will prevent adults from contacting kids without parental consent across the platform, Roblox has promised. Providing better protections for kids starts with “strengthening the account settings of children’s accounts so they are private by default,” eSafety said, and ends with Roblox making it easy to report unwanted contact and notifying users of outcomes after reports are made. Those are critical protections for Australia’s second most popular online game for kids, Inman Grant said.