GTA 6 Hacker Claims the Source Code Is Still Out There

For context: Kurtaj was 17 years old and a member of the Lapsus$ hacking group when he breached Rockstar's internal systems in September 2022. He then posted them to GTAForums before Rockstar requested their removal. At the time, Kurtaj was already on bail for hacking Nvidia and BT/EE, and his laptop had been confiscated by the police. While under police protection at a hotel, he used an Amazon Fire TV Stick connected to the hotel room television, along with his mobile phone, to access Rockstar's internal Slack system. He then threatened to release the source code if Rockstar did not contact him via Telegram within 24 hours. Rockstar later testified that the breach cost the company an estimated $5 million in recovery.

In December 2023, Kurtaj was sentenced to an indefinite hospital order. A judge ruled that he "remained a high risk to the public" and was "highly motivated to return to cybercrime as soon as possible." Doctors deemed him unfit to stand trial due to severe autism. He was placed in a secure hospital, a UK facility that blends psychiatric care with custody, until professionals determine he is no longer a threat.

If the leaked conversations are true, it's safe to say that the hacker remains very much a threat to Rockstar and the rest of the world.

What makes this story uncomfortable for Rockstar is not the possibility that a convicted hacker is posting from prison. It is the reminder that the 2022 breach ever happened at all, and that the questions it raised about Rockstar's security have never been fully answered.

Since the hack, Rockstar has fired over 30 employees, faced union disputes, and reportedly implemented Area 51-level security that includes deliberate misinformation to catch leakers. The studio has said essentially nothing about GTA 6 since confirming the November 19, 2026 release date. Strauss Zelnick confirmed marketing begins this summer. The title IDs that briefly appeared on the PlayStation Store were quickly delisted after fans exploited them.

Every layer of control Rockstar has added since 2022 was a direct response to the damage Kurtaj caused. The fact that the person at the center of that damage is now posting selfies from a prison cell and hinting about source code availability is a reminder that Rockstar's security narrative is only as strong as its weakest point.

In 2022, the weakest point was a 17-year-old with a Fire TV Stick and a phone.

Ultimately, the takeaway here is that the silence Rockstar intentionally created leaves space, and space always gets filled. Sometimes it's filled by insiders scared into silence, other times it's by AI-generated fake leaks, and in very rare instances, a convicted hacker posting from a prison cell.