FromSoftware and Bandai Namco rushed out an emergency patch for Elden Ring after discovering players had found a method to duplicate items from the Tarnished Pack DLC without paying for it. The exploit allowed users to spawn free copies of paid cosmetics and items during multiplayer sessions, undermining the monetization model for the studio's first premium cosmetic pack.
The Tarnished Pack marks FromSoftware's initial foray into cosmetic DLC for Elden Ring, featuring horse armor and related cosmetic upgrades. The pricing structure and contents represented a measured experiment by the notoriously DLC-averse studio, which has historically focused on substantial expansion content rather than cosmetic microtransactions. The appearance of an easy duplication glitch exposed vulnerabilities in how the studio implemented the paid items across multiplayer interactions.
The specifics of the exploit remain typical of Elden Ring's multiplayer architecture. Players leveraging session mechanics and item drop systems managed to circumvent purchase requirements by duplicating Tarnished Pack items through cooperative or PvP sessions. Once one player had legitimately purchased the cosmetics, others could spawn copies without spending money, spreading the items across the player base unpaid.
FromSoftware's response was swift, suggesting the studio took the breach seriously. The emergency patch closed the duplication vector and prevented further free distribution of paid content. This represents a departure from how FromSoftware typically handles cosmetic offerings. The studio's previous approach to Elden Ring monetization centered entirely on the Shadow of the Erdtree expansion, a substantial paid DLC pack released in June 2024 that added dozens of hours of story content, weapons, spells, and boss fights rather than cosmetic-only purchases.
The incident reveals the operational friction between FromSoftware's traditional design philosophy and modern live-service mechanics. The studio's fanbase has long appreciated its stance against aggressive monetization, but introducing cosmetic DLC requires stricter technical controls. Elden Ring's multiplayer system, designed around dropping items and invading other worlds, inherently creates opportunities for unintended item duplication if cosmetics integrate improperly with those systems.
The Tarnished Pack launch timing matters here as well. Coming after Shadow of the Erdtree's successful reception, cosmetic DLC seemed like a logical next step for sustainable ongoing revenue. However, the rapid emergence of an exploit suggests the implementation received insufficient internal testing under multiplayer conditions. FromSoftware has never specialized in live-service games. Dark Souls games received minimal post-launch cosmetic content, and Bloodborne received none. Sekiro had no cosmetics at all. Elden Ring's base game launched without cosmetic DLC, making this first paid cosmetic offering unfamiliar territory for the studio.
The emergency patch demonstrates FromSoftware's commitment to protecting paid content integrity, but it also highlights the growing complexity of managing a live-service title with a massive player base and active multiplayer systems. Going forward, expect more stringent testing protocols for future cosmetic releases and potentially more aggressive security measures around how items function in multiplayer environments.
This incident will not derail cosmetic DLC plans at FromSoftware. Instead, it serves as a learning moment as the studio navigates monetization models alongside its core identity of challenging, content-rich gaming experiences.