When I say “viruses” I refer to the anti-cheats themselves. Like, exactly because of what you said: they live at kernel-level (sometimes even at a lower level, like Vanguard), so they can literally see anything you do (and everything you don’t), and everything you have (and everything you don’t) and exfiltrate all that data without your knowledge, much less your consent, and if that’s not a virus (more specifically, a rootkit), then I don’t want to know what’s an actual virus…

C’mon, they can even brick your PC, as it’s demonstrated that for example Vanguard does:

Independent research & analysis on Riot Vanguard / kernel-level anti-cheat:

1. Dorner & Klausner (2024) — “If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems” (peer-reviewed, ACM ARES 2024)

https://arxiv.org/abs/2408.00500

PDF: https://arxiv.org/pdf/2408.00500

2. gmh5225 — Reverse engineering of vgk.sys (Vanguard kernel driver): IAT hooks, fake page tables, anti-debug, MSR manipulation, syscall interception

https://gist.github.com/gmh5225/2b430b6025c8888196dd95c8557bfc6f

3. Archie OSU (2025) — Vanguard dispatch table hook analysis

https://archie-osu.github.io/2025/04/11/vanguard-research.html

4. Systematic Review (Dec 2025) — “A Systematic Review of Technical Defenses Against Software-Based Cheating in Online Multiplayer Games”

https://arxiv.org/html/2512.21377v1

5. Quarkslab (2025) — CVE-2025-8061 Part 1: Lenovo LnvMSRIO.sys exposes arbitrary physical memory R/W and MSR R/W to any local process

https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html

6. Quarkslab (2025) — CVE-2025-8061 Part 2: Building a kernel rootkit from the same primitives

https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061_part2.html

7. zonifer.dev (2026) — gdrv3.sys: Signed Gigabyte kernel driver with 13 unauthenticated hardware access primitives (physical memory R/W, MSR R/W, kernel memcpy, raw IO)

https://zonifer.dev/posts/byovd-kernel-driver-hardware-primitives.html

8. Check Point Research (Aug 2026) — “BTR Reforged”: Microsoft’s own signed BTR.sys driver weaponized as a universal kernel operation engine (no vulnerability required)

https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/

9. Shattered.io (2026) — Comprehensive overview: the DMA “bricking” incident, the four UEFI CVEs, Kunal Ganglani’s statement on unaudited kernel drivers, and the Genshin Impact mhyprot2.sys BYOVD precedent

https://shattered.io/vanguard-anti-cheat-2026/

10. Wikipedia: Kernel-level anti-cheat (references the Dorner & Klausner paper)

https://en.wikipedia.org/wiki/Kernel-level_anti-cheat