Salut Tech

Why CS2 Has No Kernel Anti-Cheat (and Probably Never Will)

Published

How VAC, VACnet and Trust Factor fit together, and what kernel anti-cheats offer in comparison. A look at Valve's approach through its public statements and the events of 2026.

Watch on YouTube

Sources

S1

Steam introduced kernel anti-cheat disclosures in October 2024; Battlefield 6 carries the label, while CS2 lists only VAC.

30 October 2024; store pages accessed 20 October 2026.

S2

FACEIT Anti-Cheat combines an application running during matches, a kernel driver loaded at system startup and a server component.

Approximately 2025.

S3

FACEIT required TPM 2.0 and Secure Boot for everyone from 25 November 2025, then IOMMU and VBS for 100% of players from Season 9 in August 2026, with DMA bans documented in its reports.

23 October 2025; 14 August 2026.

S4

Windows uses ring 3 for isolated user processes and ring 0 for a shared kernel address space, where driver crashes can bring down the system and callbacks can monitor handle access.

28 October 2025; 26 September 2023.

S5

Riot explains that kernel cheat drivers can blind user-mode anti-cheats, while Vanguard On-Demand avoids startup with Windows on fully secured PCs.

24 June 2026.

S6

A 2024 study scored rootkit-like features at FACEIT 5/7, Vanguard 4, BattlEye 3 and EAC 2, noting FACEIT’s kernel callbacks and vulnerable-driver blocking.

1 August 2024.

S7

Attackers used Genshin Impact’s signed mhyprot2 anti-cheat driver to disable antivirus software before deploying ransomware.

24 August 2022.

S8

VAC detects cheat signatures and modified game files or DLLs, accepts private-cheat submissions, withholds detection details and issues permanent bans without appeal.

Accessed 20 October 2026.

S9

In 2010, VAC lead John Cook described detection code delivered to clients in small, continually changing pieces.

17 February 2010.

S10

In 2014, Gabe Newell described a detected client being marked for a future ban.

19 February 2014.

S11

AMD Anti-Lag+ detoured CS2 engine DLL functions and triggered VAC bans, which Valve began reversing on 19 October 2023.

13 October 2023; 19 October 2023.

S12

At GDC 2018, John McDonald described VACnet’s server-recorded shots, recurrent neural network, Overwatch training labels and the limits of invasive client checks.

Talk: March 2018; recording uploaded 18 June 2020.

S13

Valve announced initial VacNet 3.0 testing on a limited set of matches and provided an email address for incorrectly cancelled matches.

19 August 2024.

S14

Detection of irregular gameplay removes the player and imposes a cooldown of at least one day on the player and their party.

Accessed 20 October 2026; Steam Support information reported indirectly by CSBeacon.

S15

The name VAC Live came from game-file text rather than Valve’s public terminology.

6 April 2023.

S16

Overwatch returned to CS2 for trusted partners only.

25 April 2024.

S17

Valve’s invitation-only VacNet labeling portal exists, while dataminers report that Aim Assist, WallHack, AutoBHop and Farming Bot labels train models rather than directly ban players.

11 August 2026.

S18

Trust Factor considers CS2 and Steam history and phone numbers, and parties match at their lowest member’s Trust Factor.

Accessed 20 October 2026.

S19

On 29 July 2026 at 00:38 UTC, Valve fixed a bug that allowed malicious players to avoid being processed by VACnet.

29 July 2026, 00:38 UTC.

S20

Analyst Matt (@VACdeluxe) claimed variants of a bypass had existed for well over a year and manipulated tick/subtick input timing and order to starve VACnet of data. (community source, unconfirmed)

29 July 2026.

S21

Players reported a surge in cheaters after Premier Season 5 began on 8 July 2026.

19 July 2026.

S22

Community reports after the fix described spinbotters being flagged within a few rounds while wallhacks and triggerbots continued working. (community source, unconfirmed)

30 July 2026.

S23

After the Season 4 update on 21 January 2026 at 22:58 UTC, Alpine co-creator g3om reported a VAC ban on his own map, and Valve reversed erroneous bans on 22 January 2026.

21-22 January 2026.

S24

Valve acknowledged erroneous VAC bans in December 2025.

8 December 2025.

S25

Across 11 Valve announcements from 15 September to 14 October 2026 there was no VAC/VACnet/Overwatch disclosure; 8-9 October reports were rumours, while mercurial.gg’s flagged-match share fell from 18.0% to 8.5% between demos dated 14 September-8 October and 9-15 October 2026. (community source, unconfirmed)

9-20 October 2026.

S26

FACEIT’s Human Input Detection launched on 5 August 2026 to detect implausible play, and FACEIT attributed 40% of its May 2026 cheating bans to AI and DMA cheats.

15 July 2026.

S27

Activision says Ricochet analyses input timing, consistency and response patterns.

2 February 2026.

S28

FACEIT reported that 0.4% of matches were affected by cheating, a self-reported figure from 2023.

1 November 2023.

S29

FACEIT introduced identity verification for high-ranked players and increased cheating bans from 2 to 5 years starting with Season 9.

24 July 2026; 28 April 2026.

S30

Valve hoped Steam Machine would change anti-cheat support incentives, and CS2 has a native Linux build.

13 November 2025.

S31

Microsoft said it would continue supporting third-party kernel-mode drivers.

18 November 2025.

S32

Windows 11 25H2’s GetRuntimeAttestationReport returns a signed list of loaded drivers, with anti-cheat named as a use case.

21 January 2026.

Footage and music

Music: “Stay the Course”, “Half Mystery”, “Tyrant” and “Sincerely” by Kevin MacLeod (incompetech.com), licensed under CC BY 4.0.

Footage licensed under CC BY 3.0, edited:

GDC 2018 clips used for commentary: GDC, youtu.be/kTiP0zKF9bc.

Images:

  • “CrowdStrike BSOD at LGA” by Smishra1, Wikimedia Commons, CC BY-SA 4.0.
  • CPU die photos by FritzchensFritz, CC0.
  • Code screen by cottonbro studio, Pexels.

Counter-Strike 2 © Valve. Not affiliated with Valve or FACEIT.

Corrections

No corrections so far.

Questions, corrections or claims?

Spotted a mistake, have a question about a source, or own something used in this video? Email [email protected] with the timestamp and what you'd like changed. I read every message and fix what's wrong.

How I use other people's work
← All videos