GTA 6 Leak Investigation: What's Confirmed, Alleged and Still Unverified

For six days, a corner of the internet has been watching a countdown nobody can actually verify. According to an account calling itself CyberLeek, a mechanism is supposedly set to release a full build of Grand Theft Auto 6 unless its operator checks in daily. Nobody outside CyberLeek's circle has seen that mechanism, and the single report that described it in detail was pulled by its own publisher within a day, after the image behind it turned out to be fake (Insider Gaming).

That retraction is the clearest thing to emerge from an otherwise murky week. What isn't in dispute: gameplay footage and map material attributed to Rockstar's next release has been leaking in waves since 18 August, Take-Two has taken the matter to federal court, and the identity of whoever is behind CyberLeek remains unknown.

What happened

CyberLeek's first post landed on 18 August, days before Rockstar's own planned gameplay reveal: two short clips and a set of screenshots, including what was described as the full in-game map of the fictional state of Leonida. Neither Rockstar nor Take-Two has issued an on-the-record statement addressing CyberLeek by name since.

What followed was a drip feed rather than a single dump — driving footage, a gas-station encounter, a nighttime flying sequence, gunplay — with further clips reported into the following week. Each upload triggered fresh copyright strikes from Take-Two, and each strike was followed by another repost from a new mirror or platform.

Who is CyberLeek?

CyberLeek's real-world identity has not been established by Rockstar, Take-Two, Microsoft, Discord or any law-enforcement agency. The account has framed its actions as protest, publishing a list of demands aimed at digital-only pre-orders and disc-locked downloadable content, and has warned other publishers that if it can reach a studio as large as Rockstar, none of them are safe.

Two details complicate that protest framing. CyberLeek has launched and promoted its own cryptocurrency token, and has separately been reported to be soliciting paid advertising placements against future leaks (The Gamer). The hacktivist collective Anonymous has posted supportive commentary about CyberLeek from its official account, though that endorsement doesn't amount to verification of any claim CyberLeek has made — and consumer-rights group Stop Killing Games has explicitly condemned the leaker's methods despite sharing some of its stated goals.

What was actually leaked

The confirmed material is short gameplay clips, typically one to two minutes, plus screenshots said to show the game's map. One leaked clip reportedly showed the word "LEEK" spelled out in bullet holes on a wall, which some observers took as evidence the leaker has hands-on access to a running build rather than just recovered footage (GameSpot). No independent source has verified that a complete, playable copy of the game exists outside the clips already shown, and social-media claims of downloadable "full game" files should be treated with particular caution — such files are a common malware vector.

The dead man's switch claim

This is the single most consequential unverified claim in the story, and it deserves to be treated as exactly that. The claim originated from an image and accompanying text circulating on social media around 21–22 August, asserting CyberLeek had distributed build copies worldwide and that a public release would trigger automatically unless manually cancelled every 24 hours (WGB).

Insider Gaming published a detailed report on the threat on 22 August, then removed it and posted a follow-up acknowledging the original evidence had been fabricated and circulated by someone impersonating CyberLeek, not by CyberLeek itself. The outlet's own retraction states there is no confirmation, either way, that CyberLeek possesses a full build or any working release mechanism (Insider Gaming).

"There's no confirmation either way that CYBERLEEK does possess a full build of GTA 6." — Insider Gaming, retraction notice, 23 August 2026

At least one other outlet was caught out by the same fabricated narrative before it unravelled (GTA BOOM), and a separate write-up on the claim flagged the same logical hole regardless of the fabrication: a genuine "switch" would only work as leverage until the game's actual release date, after which the threat loses its point (Shane the Gamer). No cybersecurity researcher, platform or law-enforcement source has produced technical evidence that an automated release mechanism exists.

Take-Two's legal action

On 20 August, Take-Two — through the law firm Kirkland & Ellis — filed DMCA subpoena petitions in the U.S. District Court for the Southern District of New York directed at Microsoft and Discord, a mechanism that lets a copyright holder compel a platform to identify an alleged infringer without first filing a full lawsuit. Take-Two's counsel submitted a sworn declaration stating the purpose was to obtain the identity of the alleged infringer or infringers (Kotaku; Variety).

The scope is broad. Reporting based on the filed documents describes requests for device identifiers, registration and login IP addresses, phone numbers, linked Google and Xbox account data, and OneDrive contents, covering every account that communicated in three named Discord servers dating back to 1 June 2026 (Tom's Hardware). Both companies were given until 4 September 2026 to respond (TweakTown).

It's worth being precise about what a subpoena like this does and does not prove. It does not establish that a crime has been committed, and it does not name a suspect — it is a records request that Take-Two believes could help identify one. No arrest, charge or court finding of guilt has been reported in connection with the 2026 leaks as of publication.

What Rockstar has done

Rockstar's public posture has been silence, punctuated by copyright enforcement. Not everyone in the industry regards that as a problem. Obbe Vermeij, a former Rockstar North technical director who worked at the studio from 1995 to 2009, has called the situation a "nothing burger," arguing that most future players don't go looking for leaked clips and that Rockstar's marketing silence — not the leak itself — is what has made the footage feel more significant than it otherwise would (GamesRadar+).

Fact-check snapshot

Claim	Status
CyberLeek began leaking GTA 6 material on 18 August 2026	Strongly reported
Take-Two filed federal subpoenas against Microsoft and Discord on 20 August	Confirmed — court filing
Rockstar has publicly commented on the 2026 leaks specifically	No public statement identified
A "dead man's switch" exists that will auto-release a full build	Unverified — underlying report retracted
A complete, playable GTA 6 build has been publicly distributed	Unverified
CyberLeek is operating a cryptocurrency token tied to the leaks	Strongly reported

Timeline

• 18 August 2026CyberLeek posts its first material: two clips and screenshots said to show the Leonida map, ahead of Rockstar's planned reveal.
• 18–20 August 2026Further clips follow on consecutive days; Take-Two pursues DMCA takedowns as the material spreads.
• 20 August 2026Take-Two files DMCA subpoenas against Microsoft and Discord in the Southern District of New York, with a 4 September compliance deadline.
• 22 August 2026A report describing an alleged "dead man's switch" is published, then retracted within roughly a day after its publisher says the supporting image was fabricated by an impersonator.
• 22–23 August 2026Former Rockstar developer Obbe Vermeij publicly calls the leaks a "nothing burger."
• 27 August 2026Rockstar's previously scheduled "Grand Theft Auto VI: An Extended Look" is set to premiere on Netflix.
• 19 November 2026GTA 6's currently scheduled release date on PlayStation 5 and Xbox Series X/S.

What happens next

Two clocks are running in parallel. Microsoft and Discord have until 4 September to respond to Take-Two's subpoenas — a deadline that could produce the first concrete step toward identifying whoever is behind CyberLeek, though a response doesn't guarantee identification, and any data returned would still need to be tied to a real person before further action could follow. Separately, Rockstar's Netflix reveal on 27 August will be the studio's first scheduled opportunity to address the leaks directly, or to keep saying nothing at all.