Has Take-Two found CyberLeek? The GTA 6 leak hunt, from subpoenas to a build threat

No — not publicly. Nearly two months after Take-Two went to a federal court in New York to unmask the person behind the “CyberLeek” persona, no one has been named, charged or sued, and new footage attributed to the persona appeared on 8 October. What Take-Two has done is on the record: it filed DMCA subpoena petitions on 20 August demanding records from Microsoft and Discord, widened the hunt to X and YouTube, and asked a judge to seal a second request.

This piece is about that legal file, the one public statement Rockstar has made, and the “leaked build” downloads that a security firm has already pulled apart. It does not describe what any leaked clip shows and links to none of them. That is not squeamishness: Take-Two’s position in court is that the footage is its copyright, and repeating it would be the thing the subpoenas are about.

Has Take-Two found CyberLeek?

Not that anyone has reported. The tool Take-Two chose is designed to identify, not to punish. A subpoena under section 512(h) of the DMCA lets a copyright holder compel a service provider to identify an alleged infringer without filing a lawsuit, and no ruling on the merits is needed. If the platforms have handed over records, the next public step would be a lawsuit or a criminal referral with a name on it. Neither has appeared.

The silence cuts both ways. Take-Two told the court in its second filing that the subpoena reveals “highly sensitive, confidential information about an ongoing investigation”, which is exactly why it wanted it sealed. An investigation that is going well and one that has stalled look identical from outside a sealed docket.

What did Take-Two ask Microsoft and Discord for?

More than most people expected. From Microsoft, the petition asks for “all internal Microsoft business records and investigative records associated with” Microsoft’s own internal investigation of the persona — which tells you Microsoft had one. From Discord, it asks for “all identifying information associated with all user accounts that are/were members” of listed servers from 1 June 2026, with account IDs, registration emails, IP addresses, phone numbers, linked accounts and device identifiers.

That breadth is the contested part. TorrentFreak pointed out that 512(h) subpoenas are meant to reach alleged infringers tied to specific material, and whether every member of a server qualifies is disputed. The requests to X named three accounts; the request to Google named one video and three channels. Judges Andrew L. Carter Jr. and Jennifer L. Rochon each signed an order directing the clerk to act. Kotaku reported that the petition describes the material as including “audiovisual content” — the legal claim of ownership on which the whole effort rests.

Is the GTA 6 leak real?

For the August material, Rockstar’s own words are the closest thing to an answer. In a statement on 26 August — the day before the Extended Look aired — the studio said the leak “has been heartbreaking for our team”, apologised for how long the game had taken, and asked players to wait until 19 November despite the spoilers. That is hard to read as anything other than an acknowledgement. It did not, however, say which clips were genuine, and it has said nothing since.

The October footage is a different matter. Dexerto, reporting it on 8 October, said it had not been independently verified and that it is unclear whether it comes from the same person or group as the August clips. Treat “CyberLeek posted again” as “something was posted under that name”, which is all anyone outside the company can establish.

Is there a GTA 6 leaked build you can download?

No verified playable build has been released, and the files sold as one are worse than fake. The security firm Huntress took one apart on 9 September: an ISO posing as a leaked copy whose installer, “gta6installer.exe”, still carried the GTA V icon. Inside were, in Huntress’s words, “a fake installer, several RATs, an infostealer, ransomware being used as a wiper, and a web browser” — remote-access trojans that hand over control of the machine, a password stealer, and Chaos ransomware used to destroy files rather than ransom them.

Huntress traced the distribution to SEO poisoning “designed to rank highly in searches for GTA6”, gaming forums, social media and torrent sites — which means the people most likely to find these files are the ones searching for them this month. Its advice if you have run one is blunt: disconnect the machine, reset every password, and reimage the system.

The 10 October threat makes this more urgent, not less. A gaming creator relayed on X that the persona would release a build completable “start to finish” unless conditions were met. Dexerto reported it as an allegation, second-hand, with no confirmation that such a build exists. Whether it does or not, every file that appears under that name in the next five weeks should be assumed to be the Huntress kind.

How to tell a real GTA 6 download from a fake

One fact does most of the work. Grand Theft Auto VI is announced for PlayStation 5 and Xbox Series X|S only, sold through the PlayStation Store, the Microsoft Store, the Rockstar Games Store and retailers. No PC version has been announced. So any Windows file that calls itself GTA 6 — an .exe, an ISO, a “launcher” — is not the game, whatever else it is, and the only download that is the game starts on a console from 12 November.

GamingHQ’s list of disguises reads like a catalogue of this month’s search terms: “GTA 6 leaked build,” “GTA 6 beta,” “GTA 6 PC build,” “GTA 6 early access”, fake Rockstar launchers, and encrypted archives with dev-build names. Its advice is the only sensible one: wait for the stores.

What a memecoin and a missing disc have to do with it

From the start the leaks came wrapped in a sales pitch. VGC described the persona in August as one that appears to share confidential clips in exchange for promotion of a cryptocurrency. The October threat was framed the same way: the build would be released if a token tied to the persona revived, or withheld if Take-Two put discs in GTA 6’s boxes and apologised publicly.

The disc demand points at a real decision. Rockstar’s physical edition is a download code inside a box, available from 12 November to support pre-loading. A legitimate grievance attached to a token that profits from attention is a familiar shape, and it is the reason this piece names neither the token nor the accounts.

Has this happened to GTA 6 before?

Yes, and it ended in a courtroom. The last time, hackers published an hour of GTA 6 development footage. In December 2023 a British judge, Patricia Lees, sent Arion Kurtaj to a secure hospital with no release until a tribunal finds he is no longer a danger, saying he posed “a high risk of serious harm to the public through skill in gaining unfettered access to computers.” A 17-year-old co-defendant received a youth rehabilitation order.

The difference this time is the route. That case ended in a criminal trial; the 2026 response so far is civil, procedural and slow by design — a publisher asking platforms for names. Whether it reaches the same end depends on what those platforms returned, and that is the one part of the file nobody outside it can read.