GTA 6 gameplay leaks nine days before the official reveal

Two clips of apparent Grand Theft Auto VI gameplay, plus images of a Leonida map, began circulating on August 18, 2026. Rockstar said nothing for eight days, issuing DMCA takedown requests against people sharing it while Take-Two subpoenaed Microsoft and Discord to identify whoever is behind it. On August 26 it finally spoke, and described what happened as videos of GTA 6 gameplay leaking. That answers the question the takedowns could not: the footage is real. It answers nothing else, and we rate it separately on the leak clips being genuine.

It lands nine days before Rockstar’s own Extended Look on August 27.

Updated August 27. Rockstar has broken its silence. A statement posted to its social accounts on August 26 calls the leak “heartbreaking” for the team, apologises for how long everything has taken, describes the game as “nearly there”, and asks people to wait for November 19. It is also the first time Rockstar has referred to the material as videos of GTA 6 gameplay, which retires the authenticity question this page has carried since the 18th. It confirms no mechanic, no build date and no individual clip. Full treatment below.

Updated August 23, evening. Two corrections to what we published this morning, both of them ours. The takedown of August 22 did not hold: the count has reached ten, and clips are now being released when the token hits market capitalisation targets. And on-chain analysis has established the order of events, which settles the motive question: the domain went up on August 14 and the token was minted on August 15, before anything leaked on the 18th. Both are covered below, and the protest rating has moved to debunked as a result.

Updated August 23, morning. Cyberleek’s distribution went down on August 22. The website stopped resolving and the Telegram channel was removed for copyright infringement. A seventh clip had gone out earlier the same day. Separately, Bloomberg has reported from inside Rockstar for the first time since this began.

Updated August 22. Take-Two has now gone to federal court to unmask the leaker, with subpoenas against Microsoft and Discord filed on August 20. So the response is no longer just takedowns. The leaks have continued regardless, through a weekend in which the leaker was widely but wrongly reported arrested.

Updated August 21. This has not stopped. Cyberleek has posted new material most days since, and two things we wrote on August 19 have since been overtaken by better evidence: the clips are not tester captures, and the build is not as old as first reported. Both are corrected below. A third thing has emerged that changes how to read the whole affair: the footage carries a watermark telling you to buy a cryptocurrency.

We do not host, embed or link leaked material. This page describes what has been reported about the leak and what it is worth. It does not point you to the files, and we will not publish stills from them.

And we will not publish story spoilers from it. That is now a live question rather than a hypothetical, because the leaker has started threatening plot material. Leaked systems, a wanted meter or a fuel gauge, are fair to describe and rate. Plot is not. If a story leak lands we will report that it happened and how credible it looks, and we will not tell you what happens. Story reaches this site when Rockstar shows it or when the game is out. The full policy is on our about page.

What is in it, as reported

Two clips, each around a minute, both controlling Jason Duval:

The first is Jason at his waterfront home, shooting a basketball, with a tutorial covering the minigame’s controls.
The second is driving. His car is clipped by a delivery truck, the confrontation turns into a fist fight and then a killing, and police arrive. It ends as he approaches a helicopter.

Alongside them, images of an in-game map of Leonida. The map’s provenance is the least certain part. At least one outlet has noted it is unclear whether it came from Rockstar at all or is a fan creation.

Journalists who have watched the clips describe them as looking authentic while stressing that they cannot confirm it. Our first read, shared by most coverage at the time, was that these looked like ordinary tester captures pulled from somewhere they should not have been. That turned out to be wrong, and the correction matters. See below.

It kept going, and it is not captured video

Cyberleek has posted repeatedly since the 18th. Reported since then: a cinematic, a clip scrolling through the in-game radio stations, and footage of a plane flying over Leonida that takes in downtown Vice City and a prison.

The fifth video is the one that changed the story. It ends with the player shooting the word “LEEK” into the side of a building, one bullet hole at a time. You cannot do that with a video someone handed you. Cyberleek has, or had, a playable build of the game.

That kills the theory everyone started with, ours included: these are not tester clips found on an unsecured server. It also means the supply is not fixed. Whoever holds that build can keep generating new footage for as long as they have it, which is a different problem for Rockstar than a finite dump.

Ten drops, and a takedown that did not hold

We got this wrong this morning, so it goes first. We wrote that the supply line had closed. It had not.

The sequence, as reported:

August 21, the sixth clip. Two and a half minutes of a hypercar being taken from its driver and driven through the city. It arrived after a quiet day that had produced widespread claims of an arrest, none of them sourced.
August 22, the seventh clip. Jason robbing gas stations in the same car, with a police response.
August 22. The website stopped resolving and the Telegram channel was removed for copyright infringement. Reporting on the block describes an identifier beginning with “T2” on the interstitial, which points at Take-Two rather than at a hosting decision.
August 22 to 24, clips eight through eleven. One built around burning part of the token supply, one inside a strip club, a truck theft ending on the first Wasted screen anyone has seen, a night flight over Leonida that outlets described as containing nothing new, and a nudist town. Outlets do not fully agree on the numbering, which is what happens when releases come several times a day.

So the disruption lasted less than a day in practical terms. Taking down a website does not take down a distribution, because the distribution is other people. Each clip was mirrored across social platforms within minutes, and by the count reaching double figures the original host had stopped mattering.

The part we did get right is worth keeping: none of this recovers the build, which is the actual asset, and none of it says the leaks are over. Take-Two is still trying to establish who is behind it.

Updated August 25. Two more things have changed since. The clip released on August 23 carries the first evidence that the build contains Lucia, and Cyberleek has begun threatening to leak story spoilers. Both are below.

The build appears to contain Lucia

Every clip until August 23 was Jason. That was itself a talking point, since it fed a theory that Lucia is unavailable early in the story.

The clip released that day ends differently. After a cutscene, an on-screen prompt reads “Return to Lucia”. A mission prompt naming her is not footage of her, and it does not tell you when in the story this sits. There are two readings of that, and they predict the same evidence. Either the build is complete and these clips sit early in the story, before the point Trailer 2 showed Jason collecting her from prison, or Cyberleek holds a restricted build containing little more than the prologue, and the absence of Lucia across eleven clips is the edge of what exists rather than a fact about the game. Nothing published so far separates them, and which one is right decides whether the story material being advertised can be delivered at all.

We rate that claim, and both readings, on its own page: Lucia in the leaked build.

The threat has moved from mechanics to the story

This is the part that changes the shape of the whole affair.

Until now every clip showed systems and places: driving, fighting, a wanted meter, a gas station, a strip club, a nudist town. Annoying for Rockstar, and largely spoiler-free for players. Cyberleek has now said the next release could be a Lucia-led prologue, and framed it as a decision for the audience:

Do you want a Lucia-led prologue? CL has been evading spoilers. CL cannot just make that decision so a poll is required. Plus, to show support, 10 gamers need to show up dressed as leeks in front of Take2/Rockstar offices holding game discs during working hours.

Two observations, and the second matters more.

The release schedule is now audience-driven. Clips are already unlocked by token price and chosen by holder polls. The nudist town clip won a vote against a beach and a second strip club. This adds a real-world stunt as a further condition.

The stated restraint is doing PR work. “CL has been evading spoilers” positions the leaker as considerate while advertising the spoilers as available. It is the same move as the manifesto: a principle announced at the moment it is about to be traded away. Whether the prologue exists in that build is unverified, and nobody should treat a threat as evidence of a capability.

For what it is worth, this is the first demand in the whole campaign that has nothing to do with the consumer-rights framing that started it. Ten people in vegetable costumes outside an office is not a protest about digital ownership.

As of August 26 the prologue has not been released, and reporting puts the turnout at the offices at one person. That number is the most honest measurement anyone has of this campaign’s actual support.

Updated August 26.

The clips are now being sold, not just posted

This is the escalation, and it is the reason the count kept climbing.

Releases are no longer on a schedule or a whim. Clips are unlocked when the token reaches a market capitalisation target. The strip club footage went out after the token crossed $3 million, which had been announced in advance as the trigger. Holders also vote with the token on which clip comes next.

That is a different thing from a leaker who monetises attention after the fact. It makes the unreleased footage into inventory and the buyers into the people setting the release schedule.

The numbers around it, as of August 23: reporting puts the token’s market capitalisation near $22 to $25 million with very heavy daily volume, against roughly $29,000 spent standing the operation up and trading fees estimated at $40,000 to $60,000. Cyberleek has also burned 270 million tokens, worth about $1.4 million at the price when the transaction went through, which reads as a move to answer the cash-grab accusation.

Our position on the token has not changed and does not need to. Do not buy it. We set out why in the entry rating the protest framing.

The infrastructure came before the leak

The single most useful piece of evidence in this whole affair is a timeline, and it is checkable rather than reported.

The blockchain analytics firm Bitquery published an on-chain reconstruction on August 21, built from public chain data. Its order of events:

When	What
August 14	The domain is registered
August 15	The token is minted and first trades
August 16	The launch is announced, with a burn attached
August 18	The GTA 6 footage appears, carrying QR codes for both

Whoever set up the domain on the 14th and minted the token on the 15th already knew what was coming on the 18th. That order does not fit a leak that was later monetised. It fits a token launch that used a leak as its advertisement, which is how Bitquery frames it.

There is a detail in the same analysis that cuts against the simplest reading, and it is worth carrying. The operation did not obviously capture its own upside: the five wallets that took the most out of the first pump, about $158,000 between them, all bought inside a six-minute window on the 18th, and none of them trace back to the deployer. Roughly 16,000 retail traders came in afterwards. Where the deployer’s own proceeds went is not mapped.

So the fair summary is narrower than “the leaker got rich”, and worse in a different way. The evidence establishes the intent and the sequence. It does not establish who ended up with the money.

What is happening inside Rockstar, as reported

Bloomberg’s Jason Schreier published the first look inside the studio on August 21. It is the only reporting on this that is not derived from watching the clips, and it is worth separating from the rest.

As reported there:

Staff are “frustrated and exhausted”. Another rendering of the same sourcing adds anger.
Management has denounced the leaker internally and described the search as “all hands on deck”.
Rockstar has not identified who is responsible, and how a working build got out is not established.
Nothing is being delayed. The August 27 showing stands and the marketing plan is unchanged.

The detail that explains the mood is the history. After the 2022 breach Rockstar tightened access hard: from 2024 staff were back in the office five days a week, and reaching build servers and core tools from outside the office was largely shut off. Employees paid for that in daily working conditions for two years, and it happened again anyway.

Two caveats, because this is the kind of item that gets repeated as fact. It rests on anonymous sourcing at one outlet, and Rockstar has still not addressed the internal reporting, including in its August 26 statement. Schreier’s record on Rockstar is the reason it is being treated as reliable, which is a judgement about a reporter rather than a confirmation.

Rockstar broke its silence on August 26

For eight days Rockstar’s public answer was advertising: copyright takedowns, and promotion for the August 27 showing. No statement, no acknowledgement, no correction of anything in the clips. The evening before the showing, that changed.

The statement went up on Rockstar’s social accounts rather than as a Newswire post. The part that matters most is the first line about the leak itself:

It would be an understatement to say that having videos of Grand Theft Auto VI gameplay leak in this way has been heartbreaking for our team, and this is obviously not how we intended for you to see the game after all this time.

That is the confirmation, and it arrives sideways. Rockstar does not authenticate a list of clips and never discusses a single video. It describes the event, and the event it describes is GTA 6 gameplay leaking. Eight days of “journalists say it looks real” ends there. We rate the claim on its own page: the clips are real GTA 6 footage.

The rest of the statement is an apology for the wait, and it is unusually direct for this company:

We are very sorry that everything has taken as long as it has

The list that follows covers getting the game finished, which it puts at “nearly there”, sharing more details, and official gameplay. On the showing itself: “It has taken longer than we wanted to get it ready, but as with everything we do, we know we need to exceed your expectations.” It closes by thanking the community for messages of support, and by asking for patience:

While it is unfortunate that the intended game experience may now be impacted by some spoilers, we hope that everyone will wait a bit longer to experience the game for themselves on November 19.

Three things worth separating out of that, because the coverage will merge them:

“Nearly there” is not a release-date statement, it is a development-status one. The date is reaffirmed in the same post regardless, and November 19 stands.
“May now be impacted by some spoilers” is not a description of what leaked. Rockstar does not say which clips, does not mention the map images, and does not concede that story material is out. As of the 26th the threatened Lucia prologue had not been released.
Nothing here confirms a mechanic. Not the wanted meter, not the honor icon, not the stamina bar, not the fuel gauge. A real clip of a 2025 build is still a real clip of a 2025 build.

The timing tells you what the statement is for. It landed hours before the Extended Look, directly ahead of the footage meant to replace the leak in front of the same audience. Answering earlier would have handed the leaker a second news cycle. Answering the night before costs Rockstar nothing it was not about to spend anyway.

How old is the build, actually

Our August 19 write-up said the clips came from a build considerably earlier than the shipping version, following the early reporting, some of which suggested 2023 or even material from the 2022 breach. That is now the weakest version of the claim, and one specific observation undermines it: a radio station in one clip plays “Sports Car” by Tate McRae, released in January 2025. A build cannot contain a song that did not exist when it was made.

Where the evidence has settled is messier and worth stating honestly:

Not 2022 or 2023. The song rules that out.
Not current either. Reporting points at placeholder-looking interface elements and rough cloud textures as signs this is not the November build.
Probably 2025. Recent enough to be meaningful, old enough that anything in it may have changed.

So the original caution survives, for a better reason than we gave. The lesson from the 2022 breach still applies, and we keep a standing entry on it: features get cut, interfaces get redesigned, a detail in a capture is evidence about that capture.

There is a second trap in the reporting. A dozen outlets describing the same clip is not a dozen sources. It is one source read a dozen times, and the confidence compounds even though the evidence does not.

What the radio stations suggest

One clip lists the in-game radio line-up. Outlets transcribing it do not fully agree, which is normal for a screen recording, but several names recur: Stockyard FM, Symphony FM, Back Country Radio, Emotion, Dirty South Classics, DNU and CircoLoco Records Radio.

That last one is a quiet authenticity signal. CircoLoco Records is a real Rockstar-affiliated label that is still publishing releases on the Rockstar Newswire, most recently in August 2026. A leaker inventing a station list is unlikely to reach for a real Rockstar imprint and put it alongside a returning Vice City brand. It proves nothing on its own. It is the kind of detail that is easier to have than to fake.

The leaker has demands

The person or group taking credit goes by Cyberleek and has framed the leak as a protest, issuing what they call commandments to Rockstar and other publishers: no more digital pre-orders, no more selling DLC that is already in the base game files, and mandatory offline fallback states for single-player games. They have added that these are “the floor, not the ceiling” and threatened further leaks against publishers who fall short.

Reporting has connected that stance to Rockstar’s decision that the boxed edition contains a download code rather than a disc.

We are recording the motive because it is part of the story, not because it justifies anything. A protest about game preservation that consists of leaking someone else’s unfinished work is its own argument.

There is a cryptocurrency attached to it

This is the part that reframes everything above, and it was not in our first write-up.

The leaked videos are watermarked with an instruction to buy a memecoin, $CYBERLEEK on Solana, and carry QR codes and URLs pointing at Cyberleek’s own site, which is where the manifesto lives. The footage is the advertisement.

The price behaved the way you would expect. Reporting put the token’s market capitalisation up roughly 5,800% within an hour of the GTA 6 posts, to about $3.46 million, and back down to around $1.5 million within a day. Cyberleek says the token funds “infrastructure needed to strike” and denies it is a cash grab.

Do not buy it. Whatever the intent, an anonymous token with no disclosed treasury, promoted through stolen footage, that spikes and collapses inside a day, is not something to put money into. We have a separate entry rating the protest framing, because that claim is now doing a lot of work it cannot support.

It also changes how to read the demands. A campaign that genuinely wanted publishers to change would not need a ticker symbol in the corner of the frame.

What this does not change

The release date. November 19, 2026 still stands.
The Extended Look. Still August 27, Netflix at 3 p.m. ET, free on YouTube at 9 p.m. ET.
What is confirmed about the game. Nothing in a leak becomes an official feature. Our database only records what Rockstar has shown or stated.

Is this connected to the April breach?

Probably not, and the two are being merged carelessly. Rockstar confirmed in April 2026 that it was breached by the group ShinyHunters through a third-party analytics vendor. What was taken there was analytics data, and Rockstar stated that GTA 6 development systems were not in the affected environment. That is a different kind of incident from a build capture, and nobody has shown a link between them.

How we will handle it

Specific claims drawn from this footage go in the leak tracker with a verdict attached. Six are rated so far. The footage itself is now confirmed genuine, and whether Lucia is in that build stays open. The mechanics people took from it remain rumors: the six-star wanted level, the honor system, the stamina meter and the vehicle fuel system. If something in the clips is confirmed by Rockstar on August 27, it moves into the database then, sourced to the official showing rather than to the leak.