'Call of Duty: Warzone' and 'Vanguard' anti-cheat updates include a kernel-level driver

Activision has unveiled its big, new approach to squashing hackers in Call of Duty: Warzone and Vanguard, and it's a two-pronged system called Ricochet Anti-Cheat. The first stage is a series of server-side enhancements that will better identify and remove cheaters from games, and this is scheduled to hit Warzone with the Pacific update later this year. These new server tools will be live in Vanguard when it comes out on November 5th.

The second prong is a PC kernel-level driver designed to monitor the deepest level of every player's rig while they're in-game, in an effort to stop outside software from sneaking in through this back door. The kernel, or ring 0, is the most privileged level of any PC, granting access to every layer of hardware, and generally reserved for things like graphics card drivers and trusted bits of the operating system. The Ricochet Anti-Cheat kernel-level driver will only turn on when Warzone or Vanguard is active; it's not an always-on situation.

While operating in the kernel isn't uncommon for anti-cheat software, this is likely the most concerning part of Activision's new plans for many players. Riot Games faced scrutiny in 2020 for implementing a similar kernel-level driver in Valorant, though the main issue was that it was always on, operating even when the game wasn't active. (Confusingly, the Valorant anti-cheat system is called Vanguard).

This isn't a new worry, either — in 2013, the always-on ring 0 anti-cheat system employed by ESEA was commandeered to turn unsuspecting players' PCs into a secret bitcoin mining farm.

With these lessons in mind, Activision has stressed that Ricochet will only be active when the associated game is live, saying specifically, "the driver shuts down when you exit the game and turns on when you start a new game."

The kernel-level driver will hit Warzone alongside the Pacific update this year, and it'll come to Vanguard at a later date.

Cheating has been a significant problem in Call of Duty: Warzone for a long while now. Activision has banned more than 500,000 accounts since the game's launch, though it's not uncommon for matches to be riddled with aimbots and cheap hacks to this day. Players have been screaming for a robust anti-cheat system in Warzone and other Call of Duty titles, and Ricochet is Activision's kernel-level, not-always-on answer.