From Wikipedia:
False-positive Detections
There have been allegations that VAC has banned users for false positives.
There are six recorded instances of incorrect detections, which were fixed and rescinded:
VAC1: On its initial release, VAC would issue bans for faulty memory. Valve quickly updated VAC to only kick for faulty memory.
VAC1: Running a VAC-protected game through the Cedega software compatibility layer for Linux.
VAC1: An apparent server-side glitch on April 1, 2004.
VAC2: Over two weeks in July 2010, approximately 12,000 owners of Call of Duty: Modern Warfare 2 were banned when Steam updated a DLL file on-disk after it had been loaded into memory by the game. Those affected received a free copy of Left 4 Dead 2 or an extra copy to send as a gift.
VAC2: In January 2011, owners of Call of Duty: Modern Warfare 2 or Call of Duty: Black Ops were banned due to their computers being infected by the trojan Win32/Spyeye.H.
VAC2: In June 2011, an unknown false positive detection caused a handful of Team Fortress 2 owners to become banned.
There are four recorded instances of game plugins that are not considered cheats triggering bans.
These are:
VAC1: HLamp, which allowed the user to control Winamp from the game's interface. Detection later reversed, and all bans caused by it rescinded.
VAC2: The X-Spectate tool, which allowed server administrators to enable a wallhack effect while spectating to help decide if another player was doing the same. Later downgraded to a kick from the server, but bans not rescinded.
VAC2: The single-player Half-Life modifications Paranoia and Half-Life FX, which made changes to the engine's renderer that propagated to multiplayer games. This still triggers a ban and no bans caused by it have been reversed.
VAC and VAC2: sXe Injected, an anti-cheat system for Counter-Strike.
Cheats may be hidden inside otherwise legitimate mod or skin downloads that are created to maliciously get innocent people banned. Since the source of a cheat installed on a computer cannot be proven, bans due to this are never rescinded. Valve has "a zero-tolerance policy" for cheating and will not lift VAC bans under any circumstances. This includes account hijacking and other circumstances beyond the control of the account's owner.