How Does Facepunch Detect Rust Cheaters?

The four-layer detection stack

Rust's anti-cheat in May 2026 is not just EAC. It is a four-layer system, and three of the layers are server-side or infrastructure-level rather than kernel-mode. Understanding all four is the difference between a cheat that survives a wipe cycle and a cheat that gets caught in the first session.

Layer 1 — Easy Anti-Cheat kernel driver

Standard EAC. Same kernel scanner Epic ships across Fortnite, Apex, DayZ, Squad, and dozens of other titles. Loads at game start, sits in ring 0, scans process memory and loaded drivers, registers callbacks on process / thread / image-load operations. EAC is Facepunch's primary kernel-mode AC and gets development priority via Epic's continuous updates. The 16+ hardware identifiers EAC reads at session start (SMBIOS, motherboard serial, disk serials, MACs, GPU UUID, MachineGuid, etc.) are the foundation of Rust's HWID ban list.

Layer 2 — Server-side player culling (since May 2025)

This is the layer that broke most Rust cheats. Before May 2025, the Rust server transmitted every player's position to every other player in a 200m radius — and "undetected wallhack" was just reading those packets and rendering boxes. After May 2025, the server runs occlusion checks and only transmits position data for players the receiving client can actually see (or could reasonably see in the next ~1 second of movement). Naive packet-stream ESP that read enemies from the network stream sees empty space where enemies used to be. Memory-residue ESP (reading enemies from local game state, not packets) still works partially because Rust caches recently-seen players client-side for animation smoothing — but the cache is short (1-3 seconds typical). Documented publicly in the Surviving 12 Years devblog.

Layer 3 — Server-side spray-pattern analyzer (since November 2025)

This is the layer that broke most no-recoil scripts. Rust weapon recoil is deterministic — every gun has a fixed bullet-spread curve. AHK and Logitech G-Hub scripts compensated with pre-recorded inverse curves through the mouse driver. Facepunch's server-side analyzer watches the player's input stream for statistical regularities — if the inverse-curve is too perfect across enough engagements, the player flags. Their January 2026 devblog confirmed: "EAC has begun additional efforts targeting recoil cheats." Modern cheats use dynamic randomization on the recoil compensation curve.

Layer 4 — Premium Servers $15 inventory gate (since March 2025)

Not an anti-cheat in the kernel sense — an economic filter. Premium Servers require a $15 minimum Steam inventory value to join. A disposable cheat account needs $15 of Rust skins or other Steam Workshop items before it can log in. Facepunch claims this filters 98% of cheap-account-cycling cheaters because the cost-per-banned-account stops being trivial. The Premium Servers launch announcement explains the design.

Plus continuous detection at 90.8%

Per Facepunch's 2025 transparency numbers in Surviving 12 Years: 296,000 permanent bans in 2025, 42,000 temporary, 338,000 total enforcement, 16 million cheat reports received, 90.8% automated detection (vs human review), detection-time-to-ban compressed from 10 hours of playtime to under 7 hours over the year. Cumulative all-time: 1M+ permanent bans since Rust launched in 2013.

Plus the HackerOne bug bounty

Facepunch's HackerOne program has paid $300K+ to researchers through end of 2025. Every public exploit, every cheat bypass methodology that becomes findable, gets reported and patched faster than the cheat-vendor side can iterate. This is not anti-cheat technology per se — it is anti-cheat operations. Combined with the explicit "new third-party anti-cheat layer in 2026" hint in Surviving 12 Years, the practical implication is that the Rust cheat-buying market keeps narrowing through 2026.

The Thursday wipe ban cadence

Facepunch bunches its monthly bans into the first Thursday of the new month, coinciding with the force wipe + content patch. The pattern is: a cheat's detection signature triggers during a session, the player keeps playing, and on the next first-Thursday, the ban lands alongside the wipe. This makes it harder for cheat operators to attribute the detection to a specific build version. The 2025 data points: ~19,876 perm bans in April, similar in May, 15,440 in June. The Rust ban wave history cluster expands every documented wave.

Pair this with

The defense against the four-layer stack is software external cheats with dynamic recoil compensation, memory-residue ESP, and a current HWID spoofer. See the Rust Cheats Complete 2026 Guide for the full landscape, the Rust HWID spoofer guide for cross-EAC implications, and Raw Rust for the in-house product engineered around the actual detection stack.