Valve Source Code Leaks Online, Developer Says No Reason 'To Be Alarmed'

The source code for older versions of Valve games Team Fortress 2 and Counter Strike: Global Offensive have leaked online.

First posted on the /v/ board on 4chan on Tuesday, the leak includes files from 2017 and 2018 that show how Valve's Source engine works. The code isn't new, with the CS:GO code ending with Operation Hydra and TF2 stopping with Jungle Inferno. But with this information, those with ill intent could potentially harm your computer and install malware without your approval. Some online have theorized that a "remote code execution" could be enacted with this code, allowing an attacker to take over your computer.

valve source code team fortress 2 hack
Team Fortress 2 players shouldn't be worried Valve

Team Fortress 2 hasn't received many updates over the past few years and a user on "Unknown Cheats" even claims that they were able to create a piece of code that will instantly revive you in a Team Fortress 2 match. "With the recent leak, I figured i might as well post this since it's probably going to get figured out real fast anyway," the post reads.

Creators.TF and Red Sun, sites that allow you to share or import asset packs and content for Team Fortress 2, have announced that they will be shutting down their servers for the foreseeable future. Conversations on reddit and Twitter warn against logging onto Team Fortress 2, claiming that these leaks could lead to vulnerabilities on your end.

Someone leaked source code of these two games on 4chan and they have already found a vulnerability allowing for remote code execution, so your PC can get infected (and your game can start aimbotting) just by

— Nikki (@nikkehtine) April 22, 2020

Valve released their own statement to Newsweek and on Twitter, writing that the leaked code is believed to be a "reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018. From this review, we have not found any reason for players to be alarmed or avoid the current builds."

We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018. From this review, we have not found any reason for players to be alarmed or avoid the current builds.

— CS:GO (@CSGO) April 22, 2020

The leaker, who is known as "Maxx" online, was a part of the Lever Softworks development team for the past three years. Led by Tyler McVicker of the YouTube channel Valve News Network, their ModDB profile says that they are "a small team dedicated to bringing Valve's interesting unused assets and cancelled projects to the public for viewing and playing." Jaycie Erysdren was a developer on the team and told Newsweek that "[Maxx's] problematic behavior was actively contributing to the decline of work being done by the other members."

Erysdren claims that Maxx was "pushing [McVicker] hard to tell him insider information" and that he has "threatened to leak stuff before when he was previously in danger of being removed from the team." She also claims that Maxx would use "the N-word as parts of jokes" and would toss around transphobic comments, some of them targeted at her.

"Last week it was decided among some team members that the leaker should be taken off the team and things should be restructured," Erysdren said over Discord. "After this was finished, everyone thought that that was the end of it."

In May of 2018, the original leaker sent copies of the code to Mcvicker, Erysdren and other members of the Valve modding community. The code made its way around the community before eventually ending up in Maxx's possession.

Since the leak, McVicker's Twitter has been flooded with blame and the content creator released a statement saying he "did not leak anything." Erysdren released her own thread explaining the situation, becoming the target of many transphobic comments.

The explanation of every leak from today, April 22 2020.

The reason that this leak happened is because one of Tyler's longtime associates was recently removed from Lever Softworks due to problematic behavior including racism, homophobia and transphobia. (1/14)

— Jaycie λ✨ (@JaycieErysdren) April 22, 2020

"It seems that every time a trans person has the absolute audacity to do something that gains attention on the internet, this is the expected level of backlash," Erysdren wrote. "Needless to say the response has been very bad in some areas. I think this is what the leaker intended. I've also gotten just as many supportive messages to drown out the transphobia and hateful comments."

Maxx has been contacted on Discord but did not respond to comment.