New clips and a map image tied to the group Cyberleek have circulated for days ahead of a planned Netflix showcase for the game.
A hacker or hacker group calling itself Cyberleek claimed responsibility for a fresh wave of apparent Grand Theft Auto VI leaks that continued for multiple days through August 20, 2026, according to NBC News. The material included gameplay clips, an image described as the game's full map, and later footage that gaming outlets said suggested direct access to a playable build. The leaks surfaced just ahead of a Grand Theft Auto VI reveal reportedly tied to a Netflix showcase scheduled for August 27, 2026, prompting Rockstar Games and parent company Take-Two Interactive to pursue takedown efforts, though neither company has publicly confirmed the authenticity of the footage in the reporting reviewed here.
NBC News reported that the alleged leaker warned other publishers that “no one is safe” from similar breaches, framing the incident as part of a broader threat beyond Rockstar alone. IGN, covering the episode on August 20, described it as the “third day of leaks,” noting that one of the newest clips showed taser gameplay along with a brief cutscene. Additional outlets, including Tom's Hardware, PC Gamer, Kotaku and PlayStation LifeStyle, reported that the footage continued to expand in scope, eventually totaling five separate videos alongside the map image.
What the Leaked Footage Reportedly Shows
According to multiple reports, the leaked clips feature protagonist Jason engaged in a range of activities, including driving, fighting non-player characters, playing basketball, and flying a plane over scenery resembling Vice City. One clip reportedly showed Jason using in-game radio stations while airborne. Another showed taser-based gameplay paired with a short cutscene, according to IGN's August 20 update.
The image circulating alongside the gameplay clips was described by IGN, Tom's Hardware and other outlets as the game's full map, with some reports referring to it specifically as the Leonida map. Combined with the gameplay footage, the map image formed the bulk of the material attributed to Cyberleek during the multi-day leak window.
The 'LEEK' Wall Message and Claims of Build Access
A recurring detail across nearly every outlet's coverage involved a clip in which Jason appears to fire bullets into a wall, forming the word “LEEK.” Tom's Hardware, PC Gamer, Kotaku, PCMag and other publications described this as strong evidence that whoever captured the footage had active, hands-on control of a working game build rather than simply reposting pre-recorded internal video files.
PCMag and similar coverage said the custom bullet-hole pattern would be difficult to replicate from a static leaked video, reinforcing the impression that the leaker had real-time access to gameplay systems. Eurogamer reported that the Cyberleek account had been suspended on the platform X after the initial clips appeared, though additional footage continued to surface through other channels in the days that followed.
Unconfirmed Motive and the Question of Verification
Several outlets, including The Independent, Tom's Hardware and Kotaku, reported that Cyberleek claimed the leaks were a form of protest against the video game industry's shift toward all-digital distribution and digital-only ownership. That explanation has been presented in coverage as a self-stated justification from the leaker rather than an independently verified motive. Some reporting, including from Kotaku, also noted that the leaks appeared to be tied to promotion of a memecoin or similar cryptocurrency project, though this too was framed as an apparent side motive rather than a confirmed fact.
The Independent described the leaked material as unverified in a formal sense, since neither Rockstar nor Take-Two had issued a statement confirming the footage was genuine. However, the newspaper and other outlets noted that DMCA takedown notices targeting accounts that reposted the clips strongly implied the companies regarded the material as unauthorized and likely authentic.
Echoes of the 2022 Rockstar Breach
The Cyberleek episode inevitably drew comparisons to a separate and far more extensively documented leak from September 2022, when Rockstar confirmed a “network intrusion” after a user known as teapotuberhacker posted more than 90 videos and images of early Grand Theft Auto VI development footage, according to BBC News. That earlier hacker claimed to have breached Rockstar's internal Slack system, and investigators later identified the individual behind the breach as Arion Kurtaj, a teenager linked to the Lapsus$ hacking group. Kurtaj was later detained under the Mental Health Act and sentenced in connection with that attack.
Reporting reviewed for this story makes clear that the 2026 Cyberleek incident is a distinct event, involving a different name, different posting method and a different apparent breach pathway than the 2022 case. No source in the available coverage has linked Cyberleek directly to Kurtaj or to the earlier Lapsus$-associated intrusion. As of the most recent reporting, the true identity of Cyberleek, the exact method used to obtain the material, and the full scope of any breach remain unconfirmed.
