Embark Studios is connecting three kinds of anti-cheat detection in ARC Raiders to a substantially tougher penalty: a confirmed first offense involving a known cheat program can now cost an account permanent access, without a warning or second chance. The change reverses the studio's earlier caution about permanent first-offense bans, which partly reflected the possibility of incorrect detections.
Executive producer Aleksander Grøndal describes Denuvo's kernel-level protection, Anybrain's behavioral detection and a growing collection of internal machine-learning models using other game data. Those components are supposed to accumulate evidence and confidence before enforcement. They are not described as an autonomous AI judge, and Embark has not published the architecture, training data, decision thresholds, accuracy or system-wide false-positive rates needed to independently assess that confidence.
Detection now reaches beyond finding a cheat file
The different layers examine different evidence. Kernel-level software has deep operating-system access that can help identify memory manipulation, unauthorized drivers and interference with the game process. Behavioral analysis instead looks at what a player does: aim corrections, movement, awareness of opponents or repeated actions that resemble previously observed cheating.
This distinction matters against private or frequently updated cheats. Changing a program's code may defeat a known signature without removing the unnatural behavior it produces. Conversely, suspicious aiming alone need not establish wrongdoing; software or system evidence accompanying the same pattern can strengthen a case. Combining signals is the rationale for the layered design, not proof that the combined system cannot make mistakes.
Embark says it gathers evidence across multiple occurrences rather than immediately banning a player over one unusual signal. Staff also personally review videos and livestreams showing clear rule violations. Waiting can leave an apparent offender playing longer, while acting immediately can turn incomplete evidence into a permanent penalty. Human review adds context but cannot cover every match or guarantee correct interpretation.
The penalty follows accounts, licenses and machines
The extraction format makes cheating particularly expensive for the victim. Losing an encounter to an aimbot or wallhack can mean losing carried equipment, collected resources and the time invested in a raid. Compensation for confirmed abnormal matches can return items, but it cannot return that time or automatically restore confidence in the next match.
The new permanent-ban policy tries to remove confirmed offenders and increase the cost of returning. Embark is also restricting licenses: a sanctioned copy cannot simply be attached to a fresh account and reused, and accounts previously associated with a banned copy can themselves face permanent bans. These measures target account rotation rather than merely extending a temporary suspension.
Hardware bans carry the same logic onto the computer, preventing ARC Raiders from running on a targeted machine. Grøndal says the threshold for applying them has been lowered, with broader targeting planned later in 2026. Reaching almost every system caught running cheat software is a stated objective, not a published, verified coverage or success rate.
That wider reach also magnifies mistakes. A shared license or family computer can link people who do not control one another's actions; used components can reach an innocent buyer after a previous owner cheated. Tom's Hardware highlights the secondhand-hardware risk. Embark has not publicly detailed how it will distinguish those ownership changes from a repeat offender returning with another account.
Unusual play is not automatically dishonest play
Behavioral models can recognize combinations that traditional signature scans miss, but the same signals can have legitimate explanations. A skilled player may predict a common route, react unusually quickly or track an opponent through experience rather than illicit information. Accessibility devices and unfamiliar input methods widen the range of normal behavior.
Network instability, frame-rate problems, software conflicts, hardware faults, bugs and animation errors can also create misleading telemetry. Training data that underrepresents a legitimate playing style can turn that difference into suspicion. A more sensitive detector may produce more useful leads and more disputed cases; a conservative one can leave sophisticated cheats beneath the enforcement threshold.
Public complaints about unexplained bans and failed appeals do not independently establish that every complainant was innocent. Cheaters also have incentives to portray valid sanctions as errors. But dismissing all complaints would be equally unjustified: both automated classification and human interpretation can fail, and permanent penalties leave little room to mishandle legitimate users.
An effective appeal therefore belongs to the security system rather than being an unrelated customer-service extra. A second examination of account, license, hardware and behavioral evidence need not reveal detection signatures. Distinguishing an automated screening response from an independent review would help establish whether an error can actually be found and reversed.
Elytra remains a separate experiment
Embark is testing another system, Elytra, on a limited scale in The Finals, not announcing a completed rollout in ARC Raiders. The company calls early internal results promising but has not committed to deployment in this game. Additional evidence must be useful rather than duplicative, and performance and erroneous flags still require validation.
The existing Denuvo rollout also proceeded from a limited player group to broader availability while Embark monitored impact and performance. That sequence matters because privileged anti-cheat components can affect crashes, compatibility and frame delivery across different PCs. Completion of a rollout is not evidence of long-term reliability for every configuration.
Kernel access raises a further privacy and security question because it grants visibility ordinary applications lack. The academic proposal linked in the reporting explores protected virtual machines and a trusted monitor as a way to preserve visibility while reducing reliance on game-controlled kernel components. It is research, not a ready replacement adopted by Embark or proof that its current protections are unnecessary.
An 85% reduction measures a different intervention
Embark does provide concrete figures for queue teaming, in which players coordinate outside the game to enter the same solo lobby and cooperate against people who entered alone. The studio says it separated known offenders through matchmaking and saw an 85% reduction in players engaging in that behavior within five days.
It also reports that affected raids fell from about one in 50 to one in 300, without a meaningful increase in queue times. These are company-reported, unaudited results concerning coordinated matchmaking abuse. They are not the accuracy of a software-cheat detector, a false-positive rate, or evidence that AI identifies 85% of cheaters.
No equivalent figures have been published for confirmed software cheating, overturned bans, successful appeals or repeat offenders. The queue-teaming example is useful because it connects a specific intervention with targeted behavior, damaged matches and queue performance. It cannot supply the missing evidence for a different enforcement system.
A continuing contest, not a finished feature
Grøndal describes cheating as a multibillion-dollar industry that will not disappear; its precise size is difficult to verify because much of the business is private. Vendors have financial incentives to probe releases, update their products after patches and advertise evasion. A successful defense can itself tell an adversary which technique needs redesigning.
This explains some secrecy around detection, but players can experience silence as inaction when suspicious encounters persist. Grøndal acknowledges that simply saying the team is working on it is no longer enough. Embark must demonstrate progress without publishing a guide to bypassing the system.
Riot Games, Valve and Activision illustrate the broader industry's mix of kernel defenses, server analysis, trust measures, behavioral models and delayed ban waves. Their results cannot simply be transferred to ARC Raiders: combat cheats, account cycling, economic exploits, duplication bugs and coordinated matchmaking abuse expose different attack surfaces and require different controls.
The meaningful test is whether disrupted raids and rapid repeat offenses decline while legitimate users retain a workable route to appeal. Aggregate overturned-ban counts, appeal response times, compensation events and recurrence trends could show progress without disclosing signatures; these are potential accountability measures, not figures Embark has already provided. More hardware bans later in 2026 and any Elytra decision remain developments to assess, not completed proof of success. A delay in Elytra would not itself establish failure if the system duplicates existing capabilities or needs more validation.
Embark's achievable aim is to make cheats harder to operate, less valuable to sell and more costly to repeat, not to promise their eradication. Whether the tougher policy protects fair play depends on the whole chain—detection, evidence review, sanction, appeal and prevention of re-entry—not on how many AI models or security brands appear in it.
Sources
Embark anti-cheat update · Tom's Hardware report · Privacy architecture research · Denuvo rollout report · Permanent-ban policy report