Kernel Anti-Cheat: What It Can See and Why It Worries People

By Kim Njuki October 17, 2026 Updated: October 17, 2026 3 min read

If you play Valorant, Fortnite, PUBG, or almost any competitive PC game, you are running a kernel-level anti-cheat driver. The question people keep asking is whether that driver is a security risk, and the honest answer is: it depends on which one, and the trade-off is real.

Why they run at the kernel level

A cheat that runs at the kernel level can hide from anti-cheat software that only runs at the user level. As Riot's then-head of anti-cheat Paul Chamberlain put it in an Ars Technica interview: "Whoever's driver loads first gets to observe or influence everything that happens on your computer after that point." So anti-cheat vendors moved to the kernel to keep up — and that means their driver loads with Windows itself, before the game starts, with the deepest access the OS allows.

What the research actually found

A peer-reviewed paper, "If It Looks Like a Rootkit and Deceives Like a Rootkit," evaluated the four major anti-cheat systems — BattlEye, Easy Anti-Cheat, FACEIT, and Vanguard — against formal rootkit criteria. Its conclusion: Vanguard and FACEIT exhibit rootkit-like behavior, while BattlEye and EAC show only minor similarities, insufficient to classify them that way. The specific concerns: Vanguard and FACEIT use evasion techniques, hide from processes and threads, and block virtualization (Vanguard requires disabling Hyper-V, which also disables WSL2). All four were found to collect and transmit system information — hardware IDs, loaded drivers, module lists — continuously, regardless of whether you are suspected of cheating.

A separate 2025 analysis reached the same conclusion, noting the core problem is transparency: anti-cheat software "lacks transparency regarding the operations it performs," and because it can access system files, memory, and user directories, a vulnerability in it "could grant privileged access to attackers."

What that means for you

There is no evidence any major anti-cheat is harvesting your documents or watching you. The real, documented risks are narrower:

• A vulnerability in the driver is a system-wide risk. Ars Technica quoted security researcher Saleem Rashid: a bug in a kernel driver can crash the entire OS, and an exploit "could let an attacker install their own malicious code at an extremely low level."
• They phone home with system information — hardware IDs, loaded drivers, module lists — and you cannot fully audit what is sent.
• Vanguard runs at boot, not just when you play, though Riot now lets you disable it and re-enable it when you want to play.

The trade-off is not "privacy vs. nothing." It is "an effective anti-cheat requires deep access, and you are trusting the vendor to use it responsibly." For most players that is an acceptable risk; for a machine you use for sensitive work, it is a reason to keep your gaming and non-gaming setups separate.

Sources

• arXiv — If It Looks Like a Rootkit and Deceives Like a Rootkit (kernel-level anti-cheat analysis)
• Ars Technica — Ring 0 of fire: Does Riot Games’ new anti-cheat measure go too far?
• ISCC 2025 — How Risky Is It? A Closer Look at Game Anti-Cheat Software