Build1 distinct publisher3 min readUpdated
Take-Two's August 20 subpoenas seek install-level Windows identifiers, login IPs and OneDrive contents for every account that spoke in three servers since June 1. The predicate is a single repo takedown.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
MachineGuid is not an account, and nobody signs up for it. It is a string Windows writes during installation, and Microsoft's own support documentation says it survives hardware changes unless the OS drive is replaced [9]. That durability is what makes it worth subpoenaing. Set beside an MSA device identifier, registration and last-login IP addresses, a phone number, and whichever Google and Xbox accounts are linked to the profile, it stops being telemetry and starts working as a join key between one machine and a set of online identities [2]. The filing is not really asking Microsoft to name a leaker. It is asking for the columns you would need to match Microsoft's records against Discord's.
The records window runs from June 1, 2026 to the present [3], which is 80 days as of the filing date [1]. Odyssey.gg, which the Microsoft subpoena calls a cheat community and labels the "operator's home" [5], did not exist for the first 18 of those days: its guild ID decodes to June 19, 2026 [11]. That leaves 62 days of server for an 80-day request [3]. The same attachment asks for device telemetry wherever certain "tool/file artifacts" were present, and no list of those artifacts appears in the exhibit [8]. The Discord petition also lists 1517326120867991592 as a user ID belonging to the handle Surfer24k, while both subpoena attachments list the same number as Odyssey.gg's server ID [12].
The paperwork authorising the Microsoft demand is one notice, sent on August 19 by a Take-Two IP paralegal to GitHub's copyright address over the repository zyrexdz/cyberleek-leak-research, asserting that it "must be completely disabled, there are no remedies to rectify this clear case of infringement" [7]. The subpoenas followed a day later [5]. At the time of Tom's Hardware's report the repository was still public, with nearly 500 stars, more than 30 forks and a commit pushed at 16:18 UTC [13]. A notice that has not taken down a repository is nonetheless carrying a request for the OneDrive contents of everyone who spoke in three servers [2][3].
Two of the three servers are Odyssey-branded. The third is DarkViperAU's, which the filings themselves describe as an editors' server and whose ID decodes to January 2017 [5][10]. Matthew Judge, the Australian creator who runs it, wrote on X that "I don't know anything" [14]. Video editors who posted there sit in the same production request as the cheat community. Microsoft and Discord have 15 days from filing to answer [4][2], and they get to decide whether Attachment A is read as written. Meanwhile a sixth leaked gameplay video went up on August 21 [15], six days before Netflix premieres An Extended Look [4].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Take-Two Interactive filed two DMCA subpoenas in the Southern District of New York on August 20, demanding that Microsoft and Discord identify the person or persons behind the "CyberLeek" persona responsible for this week's Grand Theft Auto 6 gameplay leaks.
Take-Two asks for MachineGuid and MSA device identifiers, registration and last-login IP addresses, phone numbers, linked Google and Xbox connections, and OneDrive contents for every account that communicated in three named Discord servers since June 1.
Attachment A asks Microsoft to return the identifier for every account that was a member of, or communicated with any of the three listed Discord servers between June 1, 2026 and the present, in addition to the three handles named in the filings.
Both subpoenas were filed by Dale Cendali and Joshua Simmons of Kirkland & Ellis and set a September 4 deadline.
The Discord subpoena names three servers: Odyssey.gg (guild ID 1517326120867991592), "! Odyssey" (1127436882800816149) and DarkViperAU (268280696601051136); the Microsoft subpoena describes the first as a cheat community and labels it the "operator's home".
Take-Two's petition directs the Microsoft subpoena to the company as GitHub's service provider, not as the operator of Xbox or OneDrive.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Primary documents read closely, single outlet
Every substantive claim traces to the August 20 filings, Attachment A and the August 19 takedown exhibit, quoted with server IDs, handles, record categories and dates, and the outlet independently decoded the Discord snowflakes and checked the repository's live state. Evidence is nonetheless one publisher's reading of a docket, with no second outlet, no docket numbers reproduced and no confirmation from the served providers, and the filings themselves contain an unresolved ID collision and an artifact list that is referenced but absent.
Process initiated, compliance unproven
The concrete steps taken are documented: a takedown notice on August 19, two subpoenas on August 20 with a September 4 deadline, and continuing leaks through August 21. But nothing in the source shows any of it landing — the targeted repository was still public with nearly 500 stars at publication, and there is no evidence that Microsoft or Discord produced, narrowed or objected to any records. Adoption is therefore filing activity, not realized effect.
Slightly understated relative to documents
The reporting is more conservative than the material it rests on: it quotes the filings, flags what is missing rather than asserting motive, and avoids predicting outcomes. If anything, the gap runs the other way inside the documents themselves — a one-repository takedown is used to justify install-level Windows identifiers and OneDrive contents for every participant in three servers, and Microsoft is served as GitHub's provider while Xbox and OneDrive data are requested. The headline framing ('everyone in three Discord servers') is supported by Attachment A's own wording.
Strong enforcement and attention incentives on all sides
Take-Two has a direct commercial motive to maximize disclosure days before a Netflix showcase and after an April breach of its parent, and retained top-tier outside counsel to press it. CyberLeek has published a manifesto against digital-only preorders, an ideological incentive to keep leaking, and DarkViperAU has an obvious interest in distancing himself from a server named in the filings. The outlet covers a high-traffic GTA 6 story and clearly labels the author as a freelance writer with a legal background. None of these incentives are disclosed or discussed in the source itself.
Documented scope, uncertain outcome
Confidence is moderate: what was requested and when is well grounded in quoted filings and exhibits, and the outlet's ID decoding is independently checkable. What remains unknown is decisive — whether the providers comply, whether a court narrows Attachment A, whether the ID collision is a clerical error or a substantive defect, and what the unlisted 'tool/file artifacts' are. With a single publisher, no provider comment and a deadline still in the future, the scope claims deserve more trust than any inference about consequences.
product
Cyberleek dumped GTA 6 footage nine days early, with a memecoin attached and no provenance2 distinct publishers
build
Grok 4.6 lands in Copilot two days after launch, and the model picker becomes a procurement problem1 distinct publisher
product
The AI-wrote-it claim died in eight hours. The Actions injection pattern did not.1 distinct publisher
invest
Cursor ships Origin to paying users as GitHub's outage count reaches 2571 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.