Why BattlEye Does Not Run on Quest, and What VR Studios Are Using Instead

Anti-cheat on PC has known names. BattlEye and Easy Anti-Cheat both run as kernel-level drivers, loading alongside the operating system itself so they can see what a game process cannot. Neither runs on a Meta Quest. They were never built to.

A Quest game is an Android app. It ships as an APK, the Android package format, and that changes the whole trust model. There is no kernel driver to install, no vendor selling a standalone VR product, and no equivalent of the PC tooling. Until recently a Quest studio worried about cheating had exactly one option, and it was Meta Attestation.

Attestation is Meta's integrity check, and it answers one question when your app starts: is this a genuine, unmodified build running on a genuine Quest. Scott Albright, who founded Ghosts of Tabor developer Combat Waffle Studios, told UploadVR this week that one question is not enough.

"None of your major anti-cheat platforms, BattlEye, Easy Anti-Cheat, none of them run in a standalone environment," Albright said. "They just don't work. They never built them for that." On Attestation itself he was blunter. "It's so easily bypassed. Kids are just doing it with AI."

What Combat Waffle built instead

Tomahawk is the studio's own anti-cheat, now sold to other VR studios. Here is the shape of it if you are the one integrating. You add an SDK to an existing Unity, Unreal, or custom-engine project, configure the checks you want, and validate the build with their team. Six layers then run during play. Root detection blocks a rooted headset before it enters a session, integrity validation re-checks game files continuously rather than only at launch, and runtime protection watches for tampering while the game is live. Device trust, detection routing, and session enforcement handle the rest. You get a dashboard, and your moderators decide what happens to a flagged player, because Tomahawk hands over the evidence and not the verdict.

The integrity check is the blunt instrument. "We check every bit and byte of every APK to make sure it matches 100%," Albright said. Modified APKs are most of what he sees, and he says Meta was offered the method. "We've even told Meta how to do this and they refused to do it."

His numbers, from the same interview: roughly 200 rooted devices stopped by his own estimate, about 4,000 modified APK users and close to 5,000 attempted cheaters blocked since Tomahawk opened to outside studios, more than a thousand active bans, and over two million accounts protected across every title it covers. That list includes Ghosts of Tabor, protected since 2024, and Animal Company from Wooster Games. Pricing on Tomahawk's own site starts at $600 a month, scaled to average peak concurrent users.

The security team used to be the problem

The best detail in the interview is where the team came from. Combat Waffle's security group is three people, and Albright recruited them out of his own player base. "Tomahawk is actually birthed from our biggest cheaters in Tabor. We did what the Feds do. I found our biggest cheaters and we hired them." They had been writing cheats since the early Call of Duty years. The bet was that catching them would scratch the same itch.

Steam Frame is the one he has not solved

Then there is the headset this site has spent most of the year writing about. Steam Frame runs SteamOS with far more developer access than any standalone headset before it, and that openness is the reason Valve is shipping three translation layers rather than asking anyone to port. It is also, if you sell anti-cheat, the problem.

"The Frame is going to be hard to stop, because the Frame, from what I understand right now, is going to be pretty much open source where you can do whatever you want to on it," Albright said. "It's going to be rooted from Steam and they don't care." His team has Frames in the office through Valve's developer pilot and has been at the problem for a while without cracking it. He is wary of the cost of getting it wrong: "it's a lot of testing to make sure we don't brick people's headsets on accident."

Tomahawk's published roadmap puts Meta Quest at available now and mobile in development, with Quest anti-piracy, Windows PC, and SteamOS all still listed as planned. SteamOS is last of the five. With Valve's own unboxing videos already falling out of the Steam client, the hardware is going to arrive well before that tooling does.

None of which is an argument for locking the Frame down. A rootable headset is a good thing, and running what you own on hardware you paid for should not require permission. It does mean competitive studios shipping on Frame at launch will rely on whatever they build themselves, which for most small VR teams means nothing at all. If you play something PvP, that is worth asking the developer about.