CS2 VACnet Update: Valve Fixed a Bypass, Not VAC

On July 29, Valve shipped a routine CS2 update that most people would have scrolled past. Buried under a Misc heading, next to a fix for Collection Catalog XP, sat one sentence about VACnet, in Valve’s update notes for that day. Within hours, half of CS2 Twitter and Reddit had rebranded it as “Valve turns VAC back on.”

That is not quite what happened. We spent the days after the patch queuing matches, reading cheat-forum chatter, and comparing notes with what Valve actually wrote. Here is what changed, what we saw with our own eyes, and why we do not think this fixes CS2’s cheating problem.

What Actually Changed on July 29

The entire anti-cheat portion of the patch notes is one line: “Fixed a bug that allowed malicious players to avoid being processed by VACnet.” That is it. No numbers on how many accounts used the exploit, no timeline for how long it existed, and no confirmation that VACnet had stopped working altogether. The same update shipped Cologne 2026 stickers, a map-scripting fix and a few Workshop updates, which is why the anti-cheat line sat under Misc rather than in a section of its own.

The community read this as Valve flipping a switch back on. That framing is not accurate. Valve is describing a bypass being closed, not a system that was deliberately disabled and then re-enabled. The distinction matters, because a bypass fix restores detection to whatever baseline it was at before the exploit existed. It does not mean VAC is suddenly good. What we have now is the same VAC we had in season 4.

What VACnet Is, and Is Not

VACnet is the server-side, machine-learning half of Valve’s anti-cheat. It watches how a player behaves rather than scanning for known cheat signatures, and Valve last explained it publicly in a GDC talk back in 2018. That talk is still the most detailed primary source there is, which tells you how little Valve has said since.

It is also not the same thing as VAC Live, the feature that catches a cheater mid-match and cancels the game, which Valve shipped in the update of 6 June 2023. That matters for reading this patch: if VACnet never received usable data about a player, VAC Live had nothing to act on either, which is the mechanism most coverage settled on.

Why the Community Reacted So Hard

Season 5 felt different from previous seasons, and not in a good way. We did not play much of it, partly because the games we did queue had that unmistakable feeling that something was off, even when nobody was raging. A few days before July 29, we ran into a player legitimately spinbotting with the R8 revolver and taking people down through walls with headshots. In another match, a teammate was calling out enemy positions through smoke with total certainty, then eliminating fully blinded opponents without hesitation.

Neither of those needed a conspiracy theory to explain. They were just cheaters playing with no fear of consequence. So when one Misc-section bullet point blew up into a major story, it was less about the fix itself. It was about a season’s worth of pent-up frustration finally having somewhere to go. For more on how the broader trust and reporting system in CS2 works, see our CS2 trust factor guide.

What We Saw in the First Matches After the Patch

We queued 6 matches in the first 48 to 72 hours after the patch. We did not see a VAC live warning or any VAC notification during that window, despite plenty of Reddit and Discord chatter about cancellations happening to other players. What we did see was a blatant wallhacker landing headshots through smoke and through walls, in the same window everyone else was celebrating the fix.

We did not encounter any spinbotters in those 6 matches, which lines up with the broader pattern: spinbots disappeared, wallhacks persisted. It is a small sample, and it is entirely possible other rating brackets saw different results. But it is consistent with what the wider community reported in the same window:

“Played 4 matches so far today. First 2 had blatant hackers, 3rd seemed fine, 4th had blatant hackers on both teams and got cancelled.”
– u/McChickenLargeFries on r/cs2

Others in that thread had clean sessions and said so. Both can be true at once, which is exactly why judging an anti-cheat change from inside your own queue is so unreliable.

What the Cheat Forums Show

Something was moving before the patch notes existed. On July 25, four days early, a cheat-side thread was already comparing which products still had a working bypass and concluding that most did not. A server-side change needs no client update to ship, so the notes may well have documented something that had been running for days.

What we were reading ourselves in that window was different, and worth separating out: not talk of an incoming update, but talk of VAC being effectively off and cheaters being free to do whatever they wanted. That feeling, that detection was absent rather than merely imperfect, is what made season 5 feel worse than the seasons before it.

After the patch, the tone on those forums changed fast.

A cheat-side subreddit thread posted the day before the patch notes listed products as newly detected by name: Fatality, Neverlose, Memesense, AimWare and GameSense. The top reply set the expectation for what comes next: “But they will find another bypass in a day or two.”

How long the hole was open is anybody’s guess. Community estimates run from a few months to a couple of years, and not one of them comes from Valve, which gave no timeline at all. There is also a competing theory that the fix blocked a Steam IP range that let kicked cheaters rejoin the same match, rather than anything to do with spoofed movement data. Valve’s one sentence does not distinguish between the two, so anyone telling you exactly what got patched is guessing.

Displacement, Not Elimination

Blatant rage-cheating has genuinely dropped in what we have seen since the patch, and we think that is real. Even cheaters know the visible stuff can get them banned again now. But wallhacks and radar hacks are still the go-to for anyone still cheating, and both are much harder to prove than a spinning R8 headshot. You cannot tell, in the moment, whether a player stopped cheating out of fear or just switched to something subtler. There is no tell for that from the receiving end of a game.

That is the honest read of this patch: it caught the loud stuff and left the quiet stuff alone. The community landed in the same place, and the players closest to the cheats were the most specific about it:

“Only spin and lock. Trigger, wh and bunny still work, 4 matches full cheaters.”
– u/Suspicious_Machine71 on r/cs2

Anyone reporting suspected cheaters should still know how the reporting and ban systems connect, and our guide to CS2 scams and how to avoid them covers the account-security basics worth knowing regardless of anti-cheat state.

The False Positive Risk

Valve has had to reverse erroneous VAC bans twice in the last eight months, in the updates of 8 December 2025 and 22 January 2026. That history matters here, because tightening detection without perfect precision usually means some legitimate players get caught in the net.

We have not personally taken a false positive. We only play with legit players and have not had a cooldown or flag. But it is not only theory: players are reporting whole parties taking a 20-hour cooldown because one member was flagged as irregular. We also know of pros catching cooldowns over the years, Fl0m among them, which is embarrassing for Valve given that actual cheaters can otherwise play uninterrupted. If a system flags a known pro while a wallhacker runs unchecked, that says something about how far VACnet still has to go.

Why It Is Hard to Prove Any of This

One reason the arguments got so loud is that almost nobody can check the claim. Detections after this patch mostly show up as cooldowns and cancelled matches, not as a red ban on a Steam profile, so there is no public counter ticking up. We tried to pull daily ban numbers to put a figure on it and could not: the trackers people normally cite were either blocking automated access or long offline.

That spike is interesting for one reason: it falls on July 25, the same day the cheat forums above were reporting that bypasses had stopped working. Two weak signals pointing the same way is not proof, but it is more than the patch note gives us.

Will This Hold, or Is It Already Fading?

We have not seen cheating rates creep back up yet, but we would not bet on that holding. Cheaters test boundaries constantly. A few weeks of experimenting with what does and does not trigger a ban is the normal next step after any detection change. VAC has never felt consistently good in CS2. It has occasionally looked completely switched off, which is different from actually working well for a sustained period.

There is a theory in the community, and we have some sympathy for it, that a hole like this stays open on purpose: let the cheaters play, watch how they move, and use it as training data. Valve is mysterious enough that it is not absurd. But players have been making that argument for about three years now, and an explanation that never produces a visibly better anti-cheat gets thinner every season it is used.

We have not seen signs of a new bypass yet, either in-game or on the forums we follow, but that is early. If prior patterns hold, a workaround for whatever got patched on July 29 is a matter of time rather than a matter of if. Anyone frustrated with match stability in general should also check our breakdown of fixing CS2’s failed to reach any official servers error, since connection problems and anti-cheat cancellations often get lumped together even when they are unrelated.

Our Verdict

This is a bypass fix, not a system re-enablement. Valve closed a hole that let some cheaters avoid VACnet processing entirely, and the visible result is that blatant rage-cheating and spinbotting genuinely dropped in the days after. That is worth something. But within our first 3 games after the fix, we still matched blatant wallhackers shooting through walls and smokes. The bug fix restores VAC to roughly where it stood in season 4, not to some new, cheater-proof baseline. CS2’s anti-cheat problem is not solved. It is, for now, quieter.

Frequently Asked Questions