News

The GTA 6 Leak Trail Now Includes Microsoft and Discord

Court orders dated August 21, 2026, direct subpoenas to Microsoft and Discord for records tied to named accounts, servers, GitHub material, and the Cyberleek leaks; Discord said on August 24 that it had not yet been served, while responses are due September 4, 2026.

208 9 minutes read

Brian Heder stands over a map in Grand Theft Auto VI promotional artwork. — Image credit: Rockstar Games

The GTA 6 leak trail now includes Microsoft and Discord. Take-Two Interactive has obtained court approval to seek records from both companies in connection with the spread of leaked Grand Theft Auto VI material and is seeking information that could identify the person or people behind the Cyberleek leaks. Cyberleek posted another gameplay clip on August 21, described as the group’s sixth reported gameplay reveal, while the broader archive was counted at nine gameplay clips and nine map images. The alleged leaker has also claimed to have access to an early build of the game.

The U.S. District Court for the Southern District of New York approved Take-Two’s requests on August 21, 2026. The subpoenas seek account information tied to material posted on Discord and GitHub as Take-Two investigates alleged copyright infringement and attempts to trace the people behind the leaks.

The filings were covered by Kotaku and shared through a Reddit discussion. Take-Two filed multiple subpoenas in the Southern District of New York, including one dated August 20, 2026. Separate orders dated August 21 direct the court clerk to issue the subpoenas after reviewing Take-Two’s applications, a declaration from Dale Cendali, and supporting documents.

The Discord filing is identified as Case No. 1:26-mc-422, while the Microsoft matter is Case No. 1:26-mc-421. U.S. District Judge Andrew L. Carter Jr. signed the Discord order, and U.S. District Judge Jennifer L. Rochon signed the Microsoft order. Screenshots of the signed orders were shared together in a Bluesky post.

Take-Two’s Digital Millennium Copyright Act request says the company is seeking the identity of an alleged infringer to protect its rights over copyrighted audiovisual material, artwork, images, dialogue, and other creative elements. A sworn declaration submitted with the filings describes the purpose of the subpoena as identifying an alleged infringer or infringers, and the filing says Take-Two will use the information only to protect those rights.

Records sought from Discord and Microsoft

A copy of Attachment A sets out the Discord portion of the request. Take-Two is seeking records for accounts that were members of or communicated through the named servers between June 1, 2026, and the date of the filing. The requested material includes account IDs, registration email addresses, registration and last-login IP addresses, phone numbers, linked connections such as Google and Xbox, geolocation data, associated device identifiers including MachineGuid/MSA and related telemetry records, and content connected to Grand Theft Auto, Rockstar, or Cyberleek.

The request has also been described as potentially reaching personal details connected to hundreds of thousands of users, including email addresses, IP addresses, phone numbers, and other account information. The court documents identify the accounts and servers covered by the request, but they do not establish that every person whose information could fall within its scope participated in the leaks.

Attachment A names three Discord guilds: Odyssey.gg, which the filing describes as a cheat community associated with the operator; the public ! Odyssey guild at discord.gg/odyssey; and a server identified in the filing as the DarkViperAU editors’ server at discord.gg/darkviperau. The broader investigation also covers the CYBERLEEK server, material posted on GitHub, and a server associated with DarkViperAU, a popular GTA 5 YouTuber.

The account names identified in the document include CYBERLEEK, CINEMATICKROCKSTAR, and Surfer24k™. It also references the replacement handles cyberleek_west and surwest.

Take-Two is asking Microsoft for internal business and investigative records connected to its investigation of the cyberleek persona, along with information that could identify the users, people, or entities associated with it. The Microsoft request also reaches associated Xbox account information and OneDrive content connected to Grand Theft Auto, Rockstar, or Cyberleek.

Microsoft’s involvement follows a statement from Xbox Chief Technology Officer Scott Van Vliet that the company was working closely with Take-Two and Rockstar Games to protect creative works and intellectual property. The court-approved requests now place that cooperation alongside a formal legal process.

The device portion seeks related telemetry when specified tools or file artifacts are found on a device, including identifiers such as MachineGuid and MSA. Across the requests, Take-Two is also pursuing account and online-activity records that could connect the named users to the leak operation.

Discord has not yet been served

Although the court approved the Discord request, Discord said on August 24 that it had not yet been formally served. Ryan K. Rigney, the platform’s marketing director, wrote in a public statement: “Discord has not yet been served with a subpoena from Take-Two. When we do, we’ll evaluate the validity and scope before responding.”

Because Discord had not been formally served, no Discord user data had been handed over as of that statement. Rigney’s wording offered a narrower update than a rejection of the request: once service occurs, Discord plans to review the subpoena’s validity and how broadly it applies before deciding how to respond.

The court-approved requests set September 4, 2026, as the date for the requested records, but Discord’s stated lack of service means that its response process had not yet started. The filings do not reveal whether Microsoft has handed over data, and Discord’s statement does not say whether the platform will ultimately produce records.

Neither company has identified a specific person behind Cyberleek. The legal process remains active, and a subpoena is a request for records rather than proof that every named account or server participated in leaking information.

What appeared in the first GTA 6 leaks

The first two clips surfaced on Tuesday evening, August 18. One showed Jason Duval shooting basketball hoops outside his home. An on-screen tooltip appeared to award a 2% Focus boost for each successful shot, although the footage did not establish whether that system will remain in the final game.

The second clip showed Jason driving on a highway before crashing into a mail van. He fought the other driver, killed him with a wrench, and triggered a two-star police chase. Rockstar began issuing DMCA takedowns within hours, although the company has not publicly discussed the leaks.

Map images surfaced alongside the clips. One identified Dalton Island, while others marked Tequesta Retreat, Gloriana Key, and Catalan Key. A separate image purported to show the full map. Cyberleek initially claimed the footage came from a 2023 build, while at least one later piece of material was identified as a 2025 version. Neither claim establishes what will remain in the final game.

The clips also exposed several details that had not been confirmed by Rockstar. Vehicles appeared to have fuel gauges, while a minus symbol and purple devil emoji appeared after Jason harmed non-player characters, suggesting a possible karma system. Prompts at the back of Jason’s car pointed to loadout customization and vehicle storage.

Three more clips followed. One placed Jason inside a strip club with messages from the in-game WhatUp! phone app visible on screen. Another showed him taking a security guard’s taser and repeatedly kicking the guard after he fell. A third introduced Zombix, a drug whose tooltip warned that its effects would weaken with repeated use.

The radio in one clip played Tate McRae’s “Sports Car,” a song released in January 2025. That made the earlier 2023-build claim harder to accept, although the recording could have been added to the game before its official release.

On August 20, a clip showed Jason firing the word “LEEK” into the side of a building. Another showed him piloting a plane over Vice City, followed by a cutscene in which characters discussed hiding online activity through a VPN. Other leaked material reportedly included gameplay of shooting basketball hoops, a cutscene, and the game’s tracklist, taking the campaign beyond isolated gameplay clips.

After roughly 24 hours without another major release, Cyberleek posted a clip called “Hypercar” on August 21. Jason broke into a Truffade Thrax, pulled the driver from the car, and then drove through Vice City for a little more than two minutes. The footage included a stop at a stop sign.

Later material attributed to Cyberleek reportedly included gameplay and cutscenes involving Jason at a nudist gathering. The campaign also threatened to reveal story content involving Lucia unless 10 people appeared outside Take-Two’s offices wearing leek costumes. The reported threat added a story-focused angle to a leak campaign that had previously centered largely on open-world gameplay and environmental details.

Videos attributed to Cyberleek have also shown driving sequences, flying planes, chaos involving non-player characters, and combat. Copies of the videos and related screenshots have been removed from various platforms. Reuploads of the clips have nevertheless collected millions of views across social media, underscoring how widely the material has circulated.

Cyberleek’s manifesto and cryptocurrency promotion

Cyberleek presented the leaks as a protest against several industry practices. Its manifesto called for:

an end to digital preorders;
an end to downloadable content built from files already included on a game disc; and
an offline fallback for single-player games.

The group connected its message to Take-Two’s reported plan to ship GTA 6 without a physical game disc, using a download code in the box. The Stop Killing Games movement publicly rejected any association with the leak campaign, despite some overlap between its offline-access concerns and Cyberleek’s demands.

Every clip carried advertisements for the $Cyberleek cryptocurrency token, which had a market value of about $1.1 million at the time. The group also used paid polls to let token holders choose which footage would appear next. Cyberleek said the money would support a secret project and the infrastructure and security needed to withstand legal action, but the token promotion made its consumer-rights message difficult to separate from fundraising.

The group began charging for a poll asking what content people wanted to see leaked. Its website later said it was open to advertising future leaks, and Cyberleek allegedly sought as much as $164,000 in cryptocurrency simply to discuss those arrangements.

Crypto links and QR codes have appeared in the leaked videos and public channels, apparently giving the operation a direct way to promote a memecoin and make money from the attention. Cyberleek also warned that impersonator accounts had appeared on X and Discord, identifying a Telegram account and its website as the only legitimate channels. The website was taken down and later returned.

The leaks turn into a legal and market problem

The leak coincided with a sharp move in Take-Two’s share price. Market coverage from GameRant put the stock at $248.13 before it fell to $232.84 in less than two days, wiping out about $2.83 billion in market capitalization. The price later recovered to a $240.15 close, although roughly $1.5 billion of the original loss remained. Other estimates placed the lost market value at roughly $2 billion to $2.8 billion. Take-Two’s total market value was still around $45 billion.

Neither Rockstar Games nor Take-Two Interactive has publicly discussed the Cyberleek situation, leaving the subpoenas and court orders as the clearest public sign of how the companies are pursuing the matter. The filings do not establish who controls CYBERLEEK, and they do not say whether Microsoft or Discord have produced the requested material. Discord’s August 24 statement adds that the platform had not yet received formal service and had not begun evaluating the request.

DarkViperAU disputes the Discord reference

Australian creator Matthew “Matt” Judge, better known as DarkViperAU, said the server named in the subpoena is not his editors’ Discord. Judge said neither of his Discord servers has shared clips from the alleged leaks and that he knows nothing about them.

DarkViperAU addressed the subpoena in a post on X.

Take-Two has filed multiple subpoenas seeking info to catch the GTA 6 leaker. They're asking for my discord info, I'm mentioned by name.

– I don't know anything.
– That isn't my editors discord.
– There aren't even any clips of the leaks in either of my Discords.

I am… pic.twitter.com/uhhZOlvmf9

— DarkViperAU (@DarkViperAU) August 21, 2026

Judge said the alleged leaker may have visited one of his Discord servers, although he could not confirm it. He described the situation as confusing and said Rockstar Games has not contacted him by email. Judge also suggested that Rockstar would have reached out if it believed he had information about the leaks.

Judge connected the subpoena mention to an earlier exchange with the alleged leaker. After he criticized the leaker’s driving, the phrase Cyberleek can't drive later began appearing in recent leak material, he said.

The subpoena reference points to a server connected to the investigation, not proof that DarkViperAU possessed or shared the leaked content. Take-Two’s requests for information remain focused on identifying the alleged leaker and the accounts that may have interacted with them.

What could happen before the August 27 presentation

Earlier GTA 6 leaks have already led to legal consequences. A previous leak case also resulted in punishment, adding recent legal context to Take-Two’s decision to pursue the matter through formal channels; BBC News documented that case.

The known material includes nine gameplay clips, nine pieces of map imagery, and at least one build identified as a 2025 version. Earlier leaked footage focused on ordinary open-world activities such as basketball, driving, vehicle theft, and combat, while later material reportedly introduced a nudist-gathering sequence and a threat involving Lucia. None of the released material establishes what will remain in the final game, and the available footage has not confirmed a major story sequence. That could change if Cyberleek gains access to cutscenes or plot-heavy material, which would create a different kind of problem for Rockstar ahead of launch.

Rockstar Games’ next extended look at the game is scheduled for August 27, with the presentation planned for Netflix at 3 p.m. ET before its 9 p.m. ET release through the official Rockstar Games YouTube channel and Grand Theft Auto VI website, as outlined in the August 27 viewing schedule. Rockstar’s presentation may make much of the leaked footage look old, but the company still has to deal with the possibility of more releases before Grand Theft Auto VI arrives on November 19, 2026. Take-Two continues to target that release date, as detailed in the earlier release-date report.

Fake GTA 6 builds claiming to be the leaked version are circulating on piracy sites, and they contain malware rather than playable game files. Do not download footage or builds from unofficial sources.

Take-Two’s subpoenas add a legal response to the publisher’s efforts to contain leaked GTA 6 material before launch. Share your thoughts in the comments, and follow along on X, Bluesky, YouTube, Instagram, Steam, and Telegram.

Grand Theft Auto VI heads to the state of Leonida, home to the neon-soaked streets of Vice City and beyond in the biggest, most immersive evolution of the Grand Theft Auto series yet.