Why Does Valve Refuse to Implement Kernel-Level Anti-Cheat?

Cheating has long plagued the Counter-Strike community, with players routinely encountering obvious wallhackers and aimbotters in matchmaking.

Meanwhile, FACEIT or competitors like Valorant have developed aggressive kernel-level anti-cheat systems that seem to keep cheating more in check. So what has stopped Valve from following suit?

The answer isn't quite simple negligence – it's a deliberate choice rooted in the company's core values around privacy, user control, and open platforms.

Privacy Above All

Kernel-level software is the deepest level of your operating system and has access to everything on your computer. The software operates even when games are not running.

The resistance to kernel-level anti-cheat measures from Valve is based fundamentally on their respect for privacy. They have clearly indicated their perspectives that they do not regard piracy as a consumer-level problem, that they actually enable modding, that they actually enable creation of content, and that they respect privacy as a core value. They believe that kernel-level anti-cheat measures violate their principles.

Once Riot's Vanguard was launched and granted access to everything on a player's computer, the alarm bells rang for player trust. Valve has continually stated that such invasive access is not only breaking that trust but is also simply not right. Developing a good anti-cheat system without any risks to player privacy is very hard, but if a program is going to function correctly, it must have 'kernel-level access,' which means everything you have or do is viewed by the program.

This philosophy was put to the test publicly in 2014 when users of Reddit discovered that VAC was scrutinizing DNS cache entries. Gabe Newell was vocal about the matter, clarifying that the service only looked for the cache after a user was identified as running cheat software.

Further, VAC only sent the hashed contents of the DNS cache if they matched known cheat DRM servers, making up less than 0.1% of all accounts, leading to 570 bans. Gabe Newell responded by saying, "Do we send your browsing history to Valve? No. Do we care what sites you visit? Oh, dear god, no."

Security Vulnerabilities

Kernel-level anti-cheat presents a massive security risk. With millions of users, these systems become attractive targets for hackers.

If compromised, attackers could gain unrestricted access to users' systems, potentially manipulating hardware, stealing data, or bricking devices entirely.

Academic research has identified kernel-level cheat detection systems as presenting "an appealing attack vector and thus a major security vulnerability."

The Linux Ecosystem

Valve's enormous investment in making Linux a viable gaming platform makes things even harder. The Steam Deck uses SteamOS, which is a Linux distribution, and Valve has invested considerable resources in Proton to make Windows games run on Linux. Kernel-level anti-cheat is only written for the Windows kernel and cannot be easily ported to Linux because it works entirely differently.

Kernel-level anti-cheat would need to either drop Linux support entirely or support two systems. Counter-Strike has had native Linux support for many years, and this would leave Steam Deck owners and the wider Linux gaming community alienated.

The False Positive Ban Problem

Valve's number one priority is to avoid false bans. Their VAC service's delayed bans and silent detection are designed to prevent false positives. Valve learned this the hard way in 2010, as they had to lift the ban on 12,000 Call of Duty: Modern Warfare 2 players after Steam updated a DLL file after it was loaded into memory. Valve was forced to give the players a free copy of Left 4 Dead 2 as compensation.

In October 2023, many AMD graphics card owners were incorrectly banned when the feature, "Anti-Lag+", was found to be cheating. These incidents reiterate Valve's own policy that it is much more important not to erroneously ban innocent players than to correctly identify all cheating players.

Is It Even Effective?

Still, the effectiveness of such a kernel-level software when used for anti-cheating remains questionable. Even games with aggressive implementations like Battlefield still face significant cheating problems.

Kernel-level solutions do not handle the problem of "DMA (Direct Memory Access) Cheats" in any way, and they have become common in the competitive Counter-Strike. The DNS cache checks implemented by Valve in 2014, even with such a high-level solution, were evaded in 13 days.

The Path Forward

Valve continues developing VAC Live 3.0, VACnet – a detection technology using AI - and behavioral analysis tools that do not break the privacy barrier for server-side implementation. Though this method leaves certain cheats undetectable, it is consistent with Valve's philosophy of building long-term trust with its users.

The company faces an impossible choice: compromise its core values by implementing invasive surveillance software, or accept some level of cheating while pursuing privacy-respecting alternatives. For a privately-held company that doesn't answer to shareholders demanding short-term wins, the decision reflects what Valve believes gaming should be – a space where users maintain control over their own devices.