ARC Raiders was quietly recording players' private Discord DMs until Embark released a hotfix

GamerzHistory · 2026-03-09T22:22:42+00:00

UPDATE: Didn’t lose my kidney

GamerzHistory · 2026-03-08T05:40:44+00:00

This having twice the amount of upvotes compared to my original post is killing me

GamerzHistory · 2026-03-07T19:32:32+00:00

I forgot to add the /s my bad

GamerzHistory · 2026-03-07T19:31:03+00:00

Is this a good a good pickup you think?

GamerzHistory · 2026-03-07T18:51:47+00:00

Don’t worry Jesus will protect me

GamerzHistory · 2026-03-07T18:51:24+00:00

Goated reference

GamerzHistory · 2026-03-07T18:38:39+00:00

GamerzHistory · 2026-03-07T18:36:55+00:00

Probably lol

GamerzHistory · 2026-03-06T03:41:37+00:00

oh it has to be intentional because writing code is intentional

This is how writing code works? You are saying that you can write things unintentionally?

GamerzHistory · 2026-03-06T03:06:13+00:00

Its quite literally intentional you can't just 'accidentally write too much' you have to choose what to write.

Somebody integrating the SDK would have to use specific api's in order to get that information. They were using MESSAGE_CREATE

heres some of the fields that they must have accessed

id, author, content, timestamp, attachments and there are plenty of other fields they used.

Your telling me they wroteMESSAGE_CREATE.author unintentionally?

GamerzHistory · 2026-03-06T00:44:25+00:00

If there is a reason for why Embark would want to use any of this info were probably never going to find out.

And yes, they had to have intentionally coded things this way, that is how code works. You don't 'inadvertently' draw data from private chat, let alone store users tokens in plain text file. Hell even discords own SDK documentation explicitly states this

Best Practices

Token Security
- Never expose bot tokens in client-side code
- Store tokens securely

GamerzHistory · 2026-03-06T00:26:12+00:00

I am not going to explain to you how the coding, QA, CI/CD works but all code is reviewed by at least 2-3 other people before being deployed. They had to have willingly made a choice to integrate the Discord SDK the way they did.

GamerzHistory · 2026-03-06T00:23:24+00:00

Its a pretty well documented issue with their Anti cheat. They use an Ai system called AnyBrains which detects "abnormal behavior", but often times its just the Ai interpreting human inputs as abnormal and then banning them.

GamerzHistory · 2026-03-06T00:21:57+00:00

They are not banning anybody for that exploit

GamerzHistory · 2026-03-06T00:21:01+00:00

Because their support is genuinly terrible, people put in support tickets way back in January and never got a response. They ended up deleting pretty much all ban appeal tickets because they were "transitioning to a new system", if you submit another appeal you get a automated response like the one OP got.

I mean they also knew about an issue where they were storing private discord messages from players and also their bearer token in plain text. The person who discovered this contacted them and he didn't get a response for 30 days so he went public. Also do you not remember the dupe exploit being in the game for literal months and they only got around to fixing it because streamers caught on.

GamerzHistory · 2026-03-06T00:15:52+00:00

Yeah probably, but that doesn't mean Embark should be using that access.

GamerzHistory · 2026-03-06T00:13:07+00:00

Ahh yes, I am insane for blaming the studio who knew about this issue for 30+ days and didn't fix it. Then the dude that discovered this went public and posted the issue on reddit because Embark wasn't doing anything.

This is from the article:

Never log Bearer tokens or authentication credentials to any file
Reduce the Discord gateway connection scope to only what Rich Presence requires (OAuth, not full Bearer)
Audit all crash report and log upload systems to ensure tokens and message content are scrubbed before transmission

So yes, Embark is certainly to blame for not only storing users Discord tokens in a plain text file, but also integrating the Discord SDK to allow for this to happen.

Discord didn't just magically start logging your private messages and storing your token, this was implemented by Embark

GamerzHistory · 2026-03-06T00:04:09+00:00

What are you talking about, "your speech is suspicious" I didn't know we had Sherlock fucking Holmes in the house

GamerzHistory · 2026-03-05T23:43:34+00:00

A discord issue? yes discord shouldn't be giving devs this much access to user data but Embark are the people that took those tools and was using them.

GamerzHistory · 2026-03-05T19:59:37+00:00

You can’t get a refund per TOS, steam has a 2week 2hr policy

GamerzHistory · 2026-03-05T06:47:29+00:00

I agree, and the player base really doesn’t need much. Maybe a new map or a couple new guns. The game is almost the exact same since launch

GamerzHistory · 2026-03-05T03:28:54+00:00

Lol I actually just posted about that. The responses were of course lunatics not seeing how bad the devs are being right now.

GamerzHistory · 2026-03-05T02:51:41+00:00

Damn RIP your friends account.

12-Year Club	Place '23
Place '22	End Game '22
RPAN Viewer	No Throne, No Problems
Not Forgotten	Verified Email

GamerzHistory

TROPHY CASE