Salut Tech

AI Cheats Are in CS2. Catching Them Is Easy, Right?

Published

Cheats keep escalating, from a program that reads the game's memory to the kernel, DMA cards, AI that watches the screen and a phone-and-robot setup that leaves nothing on the PC. The video looks at AI anti-cheat versus AI cheats, what could actually work, and whether making or selling cheats should be a crime.

Watch on YouTube

Sources

S1

A basic external cheat has to ask Windows for access to another program’s memory, and Windows lets security software observe those access requests from the kernel.

S2

Cheats that inject code into the game leave evidence such as foreign code inside the game process, known signatures or modified game files.

S3

Valve was already investigating memory anomalies and validating suspected cheat code more than fifteen years ago. Historical reporting, not a description of VAC today.

S4

Anti-cheats often delay bans on purpose so cheat developers cannot pinpoint which detection caught them (FACEIT’s description of its own process).

S5

A cheat running in the kernel can feed false results to software running above it, which is the reason kernel anti-cheats exist.

S6

Attackers abuse vulnerabilities in legitimate, signed kernel drivers. Microsoft’s blocklist reduces this route but cannot cover every vulnerable driver.

S7

Some cheats go even lower and run as a hypervisor underneath Windows. This is an architectural threat; virtualisation itself can also be visible to an anti-cheat.

S8

DMA cheating uses a PCIe card that reads the game’s memory and exports it to a second computer.

S9

With DMA, the gaming PC only holds a piece of hardware, which can pretend to be an ordinary device. PCI devices report hardware identifiers, but the exact checks anti-cheats run are not public.

S10

FACEIT made IOMMU and VBS mandatory in stages: the rollout began in April 2025 and players above 3,000 Elo needed them from August 2025. FACEIT reports that with Season 9 (5 August 2026), both settings became required for every player; the same report confirms that Human Input Detection went live on 5 August 2026. Coverage of a requirement is not the same as stopping every cheat.

S11

In December 2025, Riot disclosed that on some motherboards pre-boot DMA protection was reported as active while the IOMMU was not initialised correctly during early boot, and worked with manufacturers on firmware fixes. It concerned certain firmware, not every motherboard.

S12

FACEIT reported 232 DMA cheat bans in Season 7 (19 November 2025 to 21 April 2026), 4.13% fewer than in Season 6, out of 1,649 cheating bans in total. Self-reported ban counts, not the number of people who cheat.

S13

In July 2021, reporting described a promoted auto-aim cheat that analysed video from a capture card on a separate computer, and Activision taking action against videos promoting it. Reporting on promotional material, not an independent test.

S14

An audit of FACEIT’s anti-cheat describes two-PC AI cheats that take the picture through a capture card and send input back over USB: “They never touch game memory.” The audit was commissioned by FACEIT.

S15

In these setups, the aim goes back into the PC through an external box that acts as a normal mouse. Activision documents legal action against hardware used to cheat.

S16

Riot calls cheats that read the screen and inject input “pixelbots”, or a “computer vision cheat”. Not every pixelbot uses AI.

S17

Phillip Koskinas of Riot’s anti-cheat team wrote in May 2025 that a screen reader running on the same PC “is insta-detect for the most part”, while for an external setup with a capture card and a separate input box “the only remaining detection is behavioral”, which needs a large sample of games. Post on X, text checked on 30 October 2026 (community source, unconfirmed).

S18

FACEIT reported 372 bans for AI cheats in Season 7, a 272% increase from Season 6, and expects that “AI cheats will become a major category of cheating in gaming over the coming years as AI continues to improve”. Self-reported figures; FACEIT does not say how many people use AI cheats.

S19

In July 2026, a clip circulated on X showing a phone filming a monitor, an app marking heads and the crosshair moving to one when the player clicks. The original author is unknown and the clip has not been shown to work in a real match (community source, unconfirmed).

S20

In 2022, YouTuber Kamal Carter built a robot that physically moved and clicked his mouse to hit targets in Aim Lab. A proof of concept, not a product.

S21

In August 2025, a later prototype moved the mousepad under the player’s hand to aim in Valorant. It only worked in the shooting range, not in real matches.

S22

On 19 August 2024, Valve announced it would no longer allow “automation (via scripting or hardware)” that circumvents core skills, such as keyboards deciding which direction wins when both are held, and that players doing it could be kicked from their match.

S23

PUBG says macro mice and scripts that cancel recoil break its rules.

S24

At CES in January 2024, MSI showed the MEG 321URX monitor with an AI feature that reads the League of Legends minimap and points to where enemies are.

S25

At DEF CON 24 in August 2016, Ang Cui and Jatin Kataria of Red Balloon Security showed they could take over a monitor’s on-screen display firmware and change the pixels on screen. The attack required physical access to the monitor’s ports.

S26

In 2018, Valve presented deep-learning cheat detection for CS:GO (VACnet) at GDC, based on gameplay behaviour rather than client-side instrumentation.

S27

Activision says Ricochet’s newer detections look at “input timing, consistency, and response patterns” to identify machine-modified input. A company claim about ongoing work, not independently verified accuracy.

S28

Researchers built an aimbot with human-like tricks (delays, curved and smoothed aim) that went undetected in 60 official CS:GO matches. A small 2020 study, not proof that it would bypass CS2 today.

S29

Coverage of the 2025 mousepad aimbot describes keeping imperfect scores and correction movements on purpose so it looks more human. A range demonstration, not proof of successful evasion.

S30

In 2022, researchers trained a model on real human mouse movement so an aimbot would aim like a person, and tested it against detectors in a controlled research environment.

S31

Anti-cheat vendors advertise “detection and prevention of all types of cheats”. A marketing claim with no independent benchmark on the page.

S32

In July 2026, Valve fixed a bug that “allowed malicious players to avoid being processed by VACnet”. Valve did not say how long the bug existed or how it worked.

S33

In January 2026, Valve said a small number of users received VAC bans by mistake and that those bans were reversed. Valve did not say which system caused the errors.

S34

FACEIT’s ban for cheating is “5 years, and 2 years more for every ban evasion attempt escalating to permanent” (policy in force since Season 9, 5 August 2026).

S35

In November 2023, FACEIT said attempted cheating affected 0.4% of matches in October 2023, about one encounter every 250 matches. A company estimate, not an independent audit.

S36

In the same post, FACEIT said it took 5.7 matches on average (down from 7.5) before action was taken against a detected cheater.

S37

FACEIT says AI and DMA cheats together made up 40% of its cheating bans in May 2026. This is a share of bans, not of players or matches.

S38

Valorant’s Fog of War: the server “withholds information about the positions of enemies” until the client needs them, revealing them slightly early to account for movement and latency. This describes Riot’s design, not CS2.

S39

Hiding enemy positions does not help once an enemy is visible on screen; Riot treats wallhacks and aimbots as separate problems. Our conclusion from Riot’s description.

S40

Riot describes DMA as an expensive form of cheating and frames its hardware security work as “significantly raising the cost of unfair play”.

S41

In 2026, Riot says DMA and pixelbots typically require extra hardware. No verified data shows these cheats getting cheaper between 2020 and 2026.

S42

South Korea’s Game Industry Promotion Act prohibits distributing, or producing for distribution, unapproved programs or devices that disturb the normal operation of games; this clause carries up to one year in prison or a fine of up to KRW 10 million. It targets distributors, not every player. Historical English translation (consolidated through 24 December 2018).

S43

In June 2018, the Incheon District Court gave a seller of Overwatch aimbots (3,612 sales) a one-year prison sentence suspended for two years, under South Korea’s information and communications network law.

S44

In 2021, Tencent and Chinese police took down a cheat operation with alleged revenue of more than US$76 million; ten people were arrested. An arrest is not a conviction, and no final judgment was verified.

S45

In May 2024, a US federal court granted Activision a default judgment against a cheat maker: US$14,465,600 in statutory damages, US$292,912 in fees and an injunction. No verified information on how much was collected.

  • Reference without link: US District Court for the Central District of California, case 2:22-cv-00051, order granting default judgment (document 185), 28 May 2024.

S46

The cheat makers in that case were based in Germany, and right after the judgment one outlet reported it was “business as usual” for them. This describes May 2024, not the situation today.

  • Reference without link: TorrentFreak, 29 May 2024.

S47

In Japan, after police acted against cheaters in June 2014, the publisher (Nexon) said the number of cheaters dropped and then rose again two or three months later.

S48

In that Japanese case, police referred three minors to prosecutors in June 2014 over obstruction of the publisher’s business. A referral is not a conviction.

S49

Some cheaters are children; legal scholarship argues that enforcement should target the businesses distributing cheats rather than individual players. An author’s argument, not a court ruling.

  • Reference without link: University of Illinois Journal of Law, Technology & Policy, 2019, issue 1, pages 241-264 (argument on page 261).

S50

Digital rights lawyers argue that broad anti-circumvention rules can burden lawful expression, code publication and security research. In the related constitutional challenge, the US appeals court ruled for the government on 2 August 2024.

Footage and music

Music by Kevin MacLeod (incompetech.com), licensed under CC BY 4.0, trimmed and mixed: “Newer Wave”, “Voltaic”, “Phantom from Space”, “Miami Viceroy”, “Envision”, “Brain Dance” and “Rising Tide”.

Gameplay under CC BY 3.0, cut and muted. The licence applies to the uploader’s contribution; Counter-Strike 2 belongs to Valve and Valorant to Riot Games.

“AI Cheats Are in CS2. Catching Them Is Easy, Right?” was created under Riot Games’ “Legal Jibber Jabber” policy using assets owned by Riot Games. Riot Games does not endorse or sponsor this project.

Short excerpts for commentary and analysis, with no reuse licence; the owners keep all rights:

Stock video under the Pexels License, cut and muted:

Viewer comments shown in the video are quoted anonymously.

Not affiliated with Valve, Riot Games, FACEIT, Activision or any other company mentioned.

Corrections

No corrections so far.

Questions, corrections or claims?

Spotted a mistake, have a question about a source, or own something used in this video? Email [email protected] with the timestamp and what you'd like changed. I read every message and fix what's wrong.

How I use other people's work
← All videos