The Disclosure
Security researcher Timothy Meadows disclosed this week that Arc Raiders, the multiplayer extraction shooter from Embark Studios, was logging players' private Discord direct messages and authentication tokens to plaintext files on their computers when Discord integration was enabled.
The discovery sent ripples through the game's community and prompted the developer to announce an emergency hotfix. The plaintext logs were stored locally in an easily accessible directory — meaning any application, malware, or person with access to the machine could read private conversations and, critically, Discord auth tokens that could be used to hijack accounts.
What Was Exposed
According to Meadows' findings, the logging occurred whenever a player had Discord's Rich Presence or overlay integration active while running Arc Raiders. The game's integration layer captured data from Discord's API — including message content and session tokens — and wrote it to local log files without any encryption or obfuscation.
| Data Type | Risk |
|---|---|
| Private DMs | Personal conversations readable by any local process or user |
| Auth Tokens | Could be used to hijack Discord accounts without a password |
| Log File Location | Stored in an easily accessible local directory — no admin rights needed to read |
Embark's Response
Embark Studios acknowledged the issue and announced an emergency hotfix is in development. The studio described the logging as "unintentional debug behaviour" that should have been stripped before the public build shipped. They advised players to disable Discord integration in Arc Raiders' settings until the patch is live, and to delete any local log files in the game's installation directory.
Players who suspect their tokens may have been exposed were also advised to reset their Discord passwords and enable two-factor authentication if they have not already done so.
What to Watch
The incident highlights how deeply third-party integrations — even common ones like Discord Rich Presence — can create attack surfaces when implemented carelessly. Embark has not yet confirmed a timeline for the hotfix, but community pressure makes a rapid turnaround likely. Players should disable Discord integration and purge local logs immediately.
Related Coverage
Epic Games Sues Fortnite Leaks Contractor
Former contractor allegedly ran leaks account "for clout" while inside the company.
GTA 6Rockstar Pulls GTA 6 IDs from PS Store
Title IDs removed after fans exploited a profile glitch to fake "Recently Played."
IndieSlay the Spire 2 — 430K Peak
Mega Crit's sequel crashed Steam and set the roguelike record.