GTA 6 leak footage from a playable 2025 build started surfacing on August 18, 2026, posted by a hacker persona called CyberLeek, and it is the biggest breach Rockstar has faced since 2022. The drops didn’t stop after the opening week — outlets were still logging new clips into early September 2026 — and we’ve tracked every video, the demands behind them, and what the mess means for the November 19 launch.
Key Takeaways
- CyberLeek has published at least six gameplay videos plus map images since August 18, 2026, and outlets were still logging new clips well into September 2026.
- The footage comes from a playable development build, not stolen clips, which raises real story-spoiler risk.
- A Tate McRae track from January 2025 heard in the footage is the clearest evidence yet that the build dates to 2025 or possibly earlier.
- Every video is watermarked with a $CYBERLEEK memecoin, and token-holder polls decide what leaks next.
- Rockstar’s only response so far is a DMCA takedown campaign and an internal email reported by Bloomberg on August 21.
- Take-Two has kept the November 19, 2026 release date, and the official Netflix “Extended Look” aired as scheduled on August 27.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
GTA 6 Leak Timeline at a Glance
Here’s every confirmed date in the CyberLeek saga, current through early September 2026:
| Date (2026) | What happened |
|---|---|
| August 18 | CyberLeek posts the first two gameplay clips — basketball, then driving and an NPC attack — plus the full Leonida map image. |
| August 19 | Third and fourth videos land: taser combat and two story cutscenes with full dialogue. |
| August 20 | A public poll selects the fifth video — Jason lands a biplane and sprays “LEEK” onto a wall in bullet holes. |
| August 21 | The sixth video (supercar driving) ends a day of rumors the leaker had been caught; Bloomberg reports an internal Rockstar email denouncing the leaks. |
| August 24 | One protester in a leek costume shows up outside Rockstar North’s Edinburgh studio, short of the ten-leek quorum CyberLeek demanded. |
| August 27 | Netflix airs “GTA 6: An Extended Look,” the official showcase, on schedule. |
| Early September | Outlets continue logging additional clips; the November 19, 2026 release date and pre-orders remain unchanged. |
A Playable Build Is Out in the Wild
The first drop: basketball, a beatdown, and the full map
The leaks started on August 18, 2026, when an account calling itself CyberLeek posted two short gameplay clips and an image of the complete Leonida map. GameSpot later traced the campaign’s start to this same mid-August window. The first clip showed protagonist Jason Duval shooting hoops on a Vice City court. The second showed him driving through traffic before attacking an NPC on the sidewalk.
Within hours the map image was everywhere. Fans have spent three years reconstructing Leonida from trailer frames and satellite-style teasers, and the leak handed them the whole thing in one file. Rockstar’s takedown notices reached the original posts fast. Mirrors reached a hundred more.
We compared the leaked map against the community-built mapping project and the differences are small but real. Several keys, islands, and interior markers in the leaked version have never appeared in official material. That was the first sign this was not recycled 2022 footage.
Four days of scheduled drops
August 19 brought a third and fourth video: taser combat and two story cutscenes with full dialogue. The cutscene leak came with a caption that read “No physical discs? Then more leeks!” August 20 added a fifth video, this one chosen by a public poll: Jason lands a biplane, steps out, and sprays the word “LEEK” onto a wall in bullet holes. Multiple outlets flagged that sequence — land the plane, then improvise graffiti with gunfire — as the clearest sign yet that CyberLeek was actively playing a live build in real time, not repackaging old capture footage.
By August 21 a sixth video of supercar driving was circulating, and Forbes reported that the fresh upload ended a day of rumors claiming the leaker had been caught. The cadence has been deliberate. One or two clips per day, each announced in advance, each tied to an audience-participation gimmick.
That drip-feed structure matters. The 2022 breach was a single 90-clip dump that Rockstar could fight in one wave of takedowns. This one was engineered to stay in the news cycle for weeks, with each drop timed to revive the story just as the previous wave of DMCA notices lands — and, as later reporting confirmed, it kept doing exactly that well past the opening week.
Why a live build is worse than stolen clips
The bullet-spelling stunt is the detail that alarmed developers we follow, and the sequence leading into it only reinforced the point. Landing a biplane and then writing a word on a wall with gunfire requires someone sitting at a controller inside a working build in real time, and Tom’s Hardware described the breach as a full working build in the leaker’s hands. The clearest clue to how old that build actually is turned out to be musical, not visual — more on that below.
A playable build means CyberLeek is not limited to whatever was copied off a server. Any mission, any cutscene, any map corner can be captured on demand. One of the leaker’s own polls asked followers to vote on revealing a “Lucia-led prologue,” which suggests access to story content Rockstar has never even hinted at.
The footage is clearly unfinished. Placeholder textures, debug overlays, and missing reflections show up across every video CyberLeek has posted. Rockstar allies have leaned on that point, arguing the leaks undersell the game the same way the 2022 clips did. True, but beside the point. Spoilers do not need polished lighting to spread.
How old is the build, really?
Rockstar has never confirmed a date for the leaked build, so outsiders have been left to reverse-engineer one from whatever slips into frame. The best clue so far is musical, not visual: a Tate McRae track that came out in January 2025 can be heard playing in one of the leaked clips. Multiple outlets have pointed to that detail as evidence the footage comes from a build that is at least a year old, and some reporting argues it could be older still — a licensed song only proves the earliest possible date a scene was captured, not the latest.
That reframes the “2025 build” label this leak has carried since day one. It is probably not a rough guess. Placeholder textures, missing reflections, and debug overlays across every clip CyberLeek has posted are consistent with a build that old rather than anything close to a near-final version heading into a November launch.
The practical upshot is a split verdict. An older build lowers the odds that the leak reveals current, close-to-final design decisions, which is the argument Rockstar allies keep making. It does nothing to lower the spoiler risk, since cutscene dialogue and story beats captured on an old build are still the same dialogue and story beats Rockstar plans to ship. Old code, same plot.
The drip-feed didn’t stop at six
The six-video count that made headlines in the campaign’s first week was never the ceiling. Firstpost, covering the clip where Jason lands a plane and sprays “LEEK” in bullet holes, logged it as the fifth GTA 6 leak inside a single week — a tally that only makes sense if new clips kept landing after the original burst. Mashable’s count runs further still, tallying four additional clips released since the prior Friday on top of the earlier material, which puts the real total above the six videos this story started with. GameSpot traces the campaign back to mid-August 2026, when CyberLeek first began publishing unreleased material, and describes what followed as a growing set of clips and map images rather than a single dump.
That matches the pattern we flagged from the start: this was built to be a drip, not a flood. Outlets were still logging new uploads and images well past the four-day burst that made CyberLeek a household name among GTA fans, with no sign the campaign ran out of material heading into September 2026.
For Rockstar, the math is bad either way. Six leaked videos or several more, the DMCA queue is the same fight, just fought at a larger scale with no sign the well has run dry.
Who Is CyberLeek?
The memecoin machine
Every leaked video carries a watermark advertising $CYBERLEEK, a memecoin the leaker launched alongside the first drop. One overlay reads “HIGHER MARKET CAP = MORE LEEKS.” The stated plan is that trading attention funds a “secret project,” which gives the whole operation the shape of a pump scheme with stolen gameplay as the marketing engine.
This is a genuinely new species of leak. Lapsus$ in 2022 wanted ransom and clout. CyberLeek has built an incentive loop in which the audience pays to keep the leaks coming, and the leaker profits from volatility rather than from a single extortion payment. Security researchers we read expect copycats if the token holds any value.
It also creates legal exposure far beyond copyright. Tying token price to the release of stolen property invites securities and fraud claims on top of the usual Computer Fraud and Abuse Act charges. The watermark is, in effect, a signed confession attached to every clip.
Polls that decide the next leak
CyberLeek runs polls where token holders and followers vote on the next reveal. The August 20 airplane video was the first poll-selected drop. A later poll asked whether followers wanted the rumored Lucia prologue leaked, with the leaker claiming to be personally avoiding spoilers and unable to make the call alone.
The audience-participation angle is doing exactly what it was built to do. Each poll becomes its own news story before any footage exists. Gaming forums argue about what to vote for, wire services cover the vote totals, and the anticipation cycle repeats without CyberLeek spending anything.
It is worth being clear about what participation means here. Voting in those polls is voting for the continued distribution of stolen work from a studio of thousands of people. The one group conspicuously not enjoying the show is the team that built the content being drip-fed for token hype.
The Seychelles trail
Identity speculation has produced one concrete lead so far. A fan investigator traced on-chain activity connected to the $CYBERLEEK token through a Seychelles-registered exchange, a jurisdiction long favored for its loose disclosure rules. That narrows nothing by itself, but it gives investigators a subpoena target.
The 2022 precedent looms over all of it. Arion Kurtaj, the Lapsus$ teenager behind the original GTA 6 breach, was identified within weeks and later handed an indefinite hospital order by a UK court. Rockstar’s parent company had every incentive to make an example of him, and it did.
CyberLeek appears aware of the history. The persona taunts Rockstar directly in-game, mocked capture rumors by posting new footage, and keeps operational details tight. Whether that discipline survives contact with three-letter agencies and blockchain forensics is the open question of the next few weeks.
The Demands: Discs, Leeks, and Monero
A manifesto against digital-only releases
CyberLeek published a manifesto framing the leaks as protest. The stated grievances: GTA 6 shipping without a physical disc version, the industry’s habit of delisting purchased content, and digital storefronts as instruments of control. The caption on the August 19 drop, “No physical discs? Then more leeks!”, ties each leak directly to that complaint.
The manifesto also threatens other publishers with similar treatment. No names were given, but the message was aimed at every studio moving to digital-only distribution. Game preservation advocates have spent years making a version of this argument through legal channels, and most of them want nothing to do with this campaign.
We would not take the ideology at face value. A protest against digital ownership that funds itself through a speculative token is not a coherent philosophy, it is branding. The disc complaint gives sympathizers a reason to cheer, and the token gives the operation a payday either way.
The leek-costume protest and one lonely volunteer
Among the stranger demands: CyberLeek called for at least ten people to stand outside Take-Two or Rockstar offices during working hours, dressed as leeks and holding physical game discs. The demand was framed as proof of public support, with more footage promised if it happened.
On August 24 exactly one person showed up. A video posted to X showed a lone protester outside Rockstar North’s Edinburgh studio asking for “the beach leaks,” well short of the ten-leek quorum. The clip went viral anyway, because of course it did.
The stunt reveals the campaign’s real mechanics. The demands are not designed to be met. They are designed to generate exactly this kind of absurdist content, which keeps the story alive on social platforms that a straight ransom demand would never reach.
The reported ransom
Behind the theater there is a conventional extortion attempt. Multiple reports indicate CyberLeek asked for roughly $165,000 in Monero simply to open negotiations with Rockstar. Monero’s untraceable design makes it the standard currency for this kind of demand.
There is no indication Take-Two engaged. The company’s 2022 playbook was to refuse negotiation, pursue the leaker through law enforcement, and absorb the short-term damage. Nothing in its current behavior suggests a different approach this time.
The number itself is small against GTA 6’s stakes, which analysts expect to be the largest entertainment launch in history. That mismatch supports the read that the ransom is a side bet. The token, the polls, and the attention are the actual business model.
How Rockstar and Take-Two Are Responding
The takedown campaign
Take-Two’s visible response has been a rolling DMCA offensive. YouTube uploads of the leaked clips are disappearing within hours, and X posts carrying the footage are getting copyright-struck in waves. The company used identical tactics in 2022, when it also subpoenaed Discord and Microsoft to unmask uploaders.
Enforcement is losing the volume war. Every takedown wave spawns re-uploads with cropped watermarks, mirrored frames, and altered audio to dodge Content ID. The map image in particular is past containment, having been reposted, annotated, and meme-edited across every platform we checked.
The takedowns still serve a purpose beyond containment. Aggressive DMCA enforcement builds the willfulness record for eventual criminal and civil proceedings, and it keeps the leaked material off monetized channels where it would earn money for re-uploaders.
The internal email
Rockstar has said nothing publicly. Its one known response is an internal email from a senior executive, reported by Bloomberg on August 21, that denounced the leaks and promised staff the incident would not diminish “the excellent work” going into the release.
The silence is strategic and familiar. In 2022 Rockstar waited days before issuing its “extremely disappointed” statement, and Take-Two told investors the breach caused no disruption to development. That same sequence has mostly held here: internal reassurance came fast, and weeks later there still hasn’t been a public acknowledgment forcing the story’s hand.
Reporting around the email also captured the mood inside the studio. Developers who gave up remote work and accepted heavy internal security restrictions after 2022 are said to be furious that another build walked out the door anyway. Morale, not code, may be the real casualty.
What the 2022 precedent tells us
The obvious question is whether history repeats on the outcome. The 2022 breach, 90 clips from an in-development build, produced no delay. GTA 6 shipped its trailers on schedule afterward and Take-Two repeatedly confirmed the timeline. Leaks embarrass studios, but they rarely move launch dates.
The legal outcome was also decisive. Kurtaj was caught through operational mistakes within weeks, prosecuted as part of the broader Lapsus$ sweep, and became the cautionary tale for every would-be leaker since. Take-Two’s litigation machine has run this exact race before and won.
The difference this time is the live build and the incentive structure. A leaker who can generate new material on demand, funded by an audience that profits from continued leaks, is a longer siege than a one-time dump. Containment failed on day one. The race now is identification.
What This Means for November 19
The Netflix reveal collision
The timing could hardly have been worse for Rockstar’s marketing calendar. “GTA 6: An Extended Look” premiered on Netflix on August 27, the first official deep gameplay showcase, airing into an audience that had already spent more than a week watching unpolished stolen footage, with new clips still surfacing alongside it. We covered the reveal plans in our GTA 6 Ultimate Edition and Netflix reveal report.
Some analysts argued the leak accidentally set Netflix up to win. The stolen clips were debug-build ugly, and the Extended Look was most viewers’ first real look at the finished game’s presentation. The contrast between the two likely did more for Rockstar’s image than any takedown notice.
Rockstar didn’t blink on schedule. No date changes, no statement, no acknowledgment connecting the showcase to the leaks. The company bet that polish beats piracy for the mainstream audience, and the 2022 trailer record suggests that bet usually pays.
Delay odds and the release date
Nothing in the leak has touched the launch plan. The release date Rockstar confirmed in June, covered in our GTA 6 release date report, remains November 19, 2026, and pre-orders continue unaffected. Take-Two told investors after the 2022 breach that leaks caused no development disruption, and the same logic applies to a copied, possibly year-old build now.
Prediction markets agree. Delay contracts on Kalshi and Polymarket barely moved on the leak news, staying in the same range they’ve held since summer, even as new clips kept surfacing into September 2026.
The PC question is the one calendar item genuinely worth watching, and it predates the leak. Console ships first, with the PC version tracked separately, as we detailed in our GTA 6 PC release date analysis. Nothing in the leaked build changes that sequencing.
Spoiler risk for players
The practical concern for anyone planning to play in November is spoilers. Story cutscenes with dialogue are already out, and a poll about leaking the game’s prologue put that decision in front of the same audience voting on everything else. With CyberLeek still adding clips well past the original four-day burst, and outlets still counting new uploads heading into September 2026, meaningful plot content is going to be hard to avoid on gaming social media for a while yet.
Muting works better than willpower. Blocking the obvious keywords, the leaker’s handle variants, and map-related terms on X, Reddit, and YouTube cuts off most of the exposure. The clips themselves are getting struck fast enough that casual scrolling rarely surfaces them more than a day after each drop.
Our advice is simple. The official Netflix showcase from August 27 is still the real look at the game if you missed it, treat everything watermarked with a vegetable as radioactive, and let the courts handle the rest. Eleven weeks out from the biggest launch in entertainment history, the game itself has not changed at all.
Frequently Asked Questions
What did the GTA 6 leak actually show?
At least six gameplay videos and map images leaked in an initial burst between August 18 and August 21, 2026, and outlets tracked additional clips surfacing through the rest of August and into September 2026. The footage shows Jason Duval playing basketball, driving, using a taser, landing a biplane and spelling “LEEK” in bullet holes, driving supercars, and two story cutscenes with dialogue. All of it comes from an unfinished development build that a January 2025 song heard in the footage suggests is at least that old, possibly older.
Who is CyberLeek?
CyberLeek is the anonymous persona, possibly a group, publishing the leaked footage. Nobody has been identified. The persona promotes a $CYBERLEEK memecoin watermarked on every clip, runs polls to pick the next leak, and published a manifesto protesting digital-only game releases. A fan traced related crypto activity to a Seychelles-based exchange, the only public lead so far.
Is the leaked GTA 6 footage real?
Yes. The volume of material, the consistent build details across the videos, and interactive stunts like landing a biplane and then spelling “LEEK” in bullet holes confirm live, real-time access to a working build rather than fabricated or recycled clips. Rockstar’s aggressive DMCA response and its Bloomberg-reported internal email treat it as genuine.
Will the leak delay the GTA 6 release date?
There is no sign of that. The November 19, 2026 date stands, pre-orders are unaffected, and prediction-market delay odds barely moved on the news. The 2022 breach, which was larger in clip count, caused no delay either.
Did Rockstar respond to the CyberLeek leak?
Not publicly, even weeks later. Bloomberg reported an internal email from a senior Rockstar executive on August 21 denouncing the leaks and reassuring staff, and Take-Two has kept issuing DMCA takedowns across YouTube and X since. The official Netflix “Extended Look” showcase went ahead as scheduled on August 27.
What does the $CYBERLEEK memecoin have to do with the leak?
The leaker launched the token alongside the first drop and watermarks it on every video with slogans like “HIGHER MARKET CAP = MORE LEEKS.” Token attention effectively funds the operation, and holder polls decide which content leaks next. It is the first major game leak run on a memecoin incentive model, and it adds fraud exposure to the leaker’s copyright and hacking liability.
How old is the leaked GTA 6 build?
The clearest clue is a Tate McRae song from January 2025 audible in one of the leaked clips, which multiple outlets cite as evidence the build is at least a year old. Some reporting argues it could be older still, since a licensed track only proves the earliest possible date the build was assembled, not the latest. Debug overlays, placeholder textures, and missing reflections across the leaked videos are consistent with an early, unpolished build rather than anything close to a final version.
Written by Elias Virtanen – gaming and technology reporter covering the games industry, platform economics, and digital security for Tech Insider.
