What was the 2022 GTA 6 leak?

In September 2022, around 90 clips of early Grand Theft Auto VI development footage were stolen from Rockstar's internal systems and posted online. Rockstar confirmed the breach publicly on 19 September 2022.

A UK court found in August 2023 that Arion Kurtaj, a member of the Lapsus$ group, had committed the acts, including the Rockstar intrusion. He was ruled unfit to stand trial on medical evidence and received an indefinite hospital order in December 2023. He was reported in July 2026 to have been moved to prison ahead of a retrial.

Are GTA 6 leaked screenshots real?

Often not. A growing share of images presented as leaked GTA VI material are AI-generated, and Take-Two has sent cease-and-desist letters over exactly that. A convincing-looking image is not evidence of anything.

Does SixCodex publish GTA 6 leaks?

No. We report on leaks as events but do not host, embed, link to or detail the contents of leaked material — both for legal reasons and because mixing leaked claims with confirmed facts would defeat the purpose of the site.

GTA 6 Leaks: The 2022 Hack, the 2026 Footage, and How to Read Them

More of what the internet believes about this game comes from two leaks than from anything Rockstar has published. That is worth understanding properly — including the part where a lot of what circulates as leaked material is not leaked material at all.

What this page is, and is not. It reports on the leaks as events: what happened, what was established in court, and what is being done about it. It does not host, embed, link to or describe the contents of leaked material. That is a deliberate editorial line, explained at the bottom.

September 2022: the Rockstar breach

On 18 September 2022, roughly 90 clips of early development footage from Grand Theft Auto VI were posted to GTAForums by a user operating under the alias “teapotuberhacker”. The material had been taken from Rockstar's internal systems.

Rockstar confirmed the breach publicly the following day, stating that it had “recently suffered a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from our systems, including early development footage for the next Grand Theft Auto”. The studio said it was “extremely disappointed to have any details of our next game shared with you all in this way”, and did not anticipate disruption to its live services or to long-term development.

That last part turned out to be true. The game was announced 14 months later and has been delayed twice for reasons Rockstar has attributed to polish, not to the breach.

The legal outcome

22–23 September 2022 Arrest
City of London Police arrested a 17-year-old in Oxfordshire in connection with the intrusion.
23 August 2023 Southwark Crown Court
A jury found that Arion Kurtaj, by then 18 and a member of the Lapsus$ group, had committed the acts alleged — including the Rockstar intrusion, carried out while on bail using a device connected to a hotel television. Because he had been ruled unfit to stand trial on medical evidence, the jury was asked only whether he had committed the acts, not to return a conventional verdict.
21 December 2023 Sentencing
An indefinite hospital order under the Mental Health Act. A second defendant, 17 at the time of the offences, received an 18-month youth rehabilitation order.
July 2026 Reported transfer and retrial
Kurtaj was reported to have been moved from secure hospital to prison following a reassessment, with a retrial reported as scheduled for November 2026 — the same month the game launches. We have not been able to verify the retrial date against a court listing.

August 2026: the second leak

Shortly before Rockstar's official Extended Look presentation, unauthorised footage circulated from a source using the handle “Cyberleek”. Rockstar publicly described the leaks as heartbreaking.

Take-Two responded with a legal campaign. Through its outside counsel it filed DMCA subpoenas against Discord and Microsoft on 19 August 2026, and against X Corp and Google on 20 August 2026, seeking account details, registration emails, IP logs and device identifiers associated with accounts distributing the material.

Where that campaign went wrong

Two incidents are worth recording, because they say something about how broad the net was:

On 20 August 2026, a takedown notice tied to the campaign hit a GameStop social media post that used an official Rockstar press screenshot — material Rockstar had itself published for exactly that purpose.
On 26 August 2026, a notice sent through a brand-protection vendor, invoking trademark rather than copyright, briefly locked the account of games journalist Stephen Totilo over a post containing nothing but screenshots of publicly filed court orders. The account was restored and the claim withdrawn after he objected. Neither Take-Two nor the vendor commented publicly.

Take-Two is entitled to defend its property, and a company facing a genuine leak of an unreleased product has a real problem. It is also true that an enforcement process which takes down a retailer's use of official press assets and a reporter's screenshots of public court documents is not working precisely.

The AI fake problem

This is the part that changes how you should read anything labelled “GTA 6 leak” in 2026.

A substantial and growing share of “leaked screenshots” are generated images, made to look like stolen development footage. In April 2026 a fan account posted a public apology after receiving a cease-and-desist from Take-Two over AI-generated images built to resemble leaked GTA VI screenshots, acknowledging they “risked confusing fans with real leaks”.

The practical consequence: a convincing-looking image proves nothing. Not the lighting, not the HUD, not the artefacts. The old heuristics for spotting fakes do not survive current image generation, and the people producing them are optimising directly against those heuristics.

How to read a claimed leak

Ask what the claim is attached to. A named source with a track record and something to lose is different from an anonymous account posting an image.
Check whether it contradicts anything Rockstar has said. Official statements are the only fixed points available.
Notice when a “leak” confirms what everyone already wanted. That is the cheapest fake to make and the easiest to spread.
Treat age as unknown. Even genuine leaked material from a development build may be years old and describe features that no longer exist. This is the single most misunderstood thing about the 2022 leak: it showed a game in progress, not the game being shipped.

Our policy on leaked material

We report leaks as news. We do not host them, embed them, link to them, or lay out their contents as though they were product information.

Two reasons, and the second is the one that matters more:

The legal one. Distributing stolen material from an unreleased game is not a defensible position, and the enforcement record above is not theoretical.
The editorial one. The whole point of this site is that when something here is labelled confirmed, you can rely on it. A site that publishes leaked feature lists next to confirmed ones has quietly destroyed the only thing it was offering. Everything on the confirmed list is there because Rockstar said it.

GTA 6 Leaks: What Happened, and How to Read Them