Arc Raiders Logged Discord DMs and Tokens in Plaintext Files

Security researcher Timothy Meadows disclosed that Arc Raiders logged private Discord DMs and authentication tokens to local plaintext files when players linked their Discord accounts to the game. Embark Studios deployed an emergency hotfix within 48 hours of the disclosure.

Arc Raiders Security Vulnerability | What Was Exposed

The vulnerability affected Arc Raiders' Discord Rich Presence integration. When a player linked their Discord account, the game wrote a plaintext log file containing recent DM previews, server names, and — critically — the user's Discord authentication token. Anyone with access to the player's PC could read these files without special tools.

Embark Studios Response | Hotfix and Transparency

Embark Studios acknowledged the vulnerability within hours of Meadows' disclosure and deployed a hotfix that removed the logging behavior entirely. The studio confirmed that no data was transmitted externally — the issue was limited to local file storage — but recommended affected players rotate their Discord tokens as a precaution.

Gaming Security in 2026 | A Growing Attack Surface

The Arc Raiders incident is the latest in a series of gaming security vulnerabilities involving third-party integrations. As games increasingly connect to Discord, Twitch, and social platforms, the attack surface for data exposure grows. Security researchers have called for industry-wide standards around integration data handling.

Why This Matters: The Arc Raiders vulnerability highlights a systemic issue in game development: third-party integrations are often implemented by gameplay engineers without security review. Embark's fast response is commendable, but the incident should prompt every studio using Discord Rich Presence to audit their logging practices. Auth tokens in plaintext are never acceptable.