Thirteen Terabytes of Valve Source Code and Beta Builds Leak Online

Thirteen terabytes of internal Valve development data became publicly available within the past 24 hours, distributed via torrent and accessible to anyone with the link. The archive, labeled the “Steam2” leak by the community, contains beta builds, source code, and development assets spanning from September 2003 to September 2013—the full lifespan of an era in Valve’s infrastructure. The scope places it among the largest gaming industry data breaches ever recorded, encompassing a complete decade of company development across multiple studios and franchises.

What Is Inside the Archive

The leaked data includes prerelease builds, development branches, and internal tools from thousands of games. Most notably confirmed are Portal 2, Left 4 Dead 2, Dragon Age: Origins, Batman: Arkham Asylum, Counter-Strike: Global Offensive, Half-Life 2: Episode Two, Portal, and a build labeled Episode Three—a title that has fed speculation for over 16 years, since Valve ceased public discussion of Half-Life 3. Alongside released titles, the archive contains development builds for cancelled or experimental projects and middleware libraries that Valve used during this decade.

The Scale of Pre-2014 Files

Thirteen terabytes requires historical context. Modern AAA releases routinely exceed 100 gigabytes each, but pre-2014 game builds were substantially smaller. Within this volume sits multiple development branches, version histories, debug builds, and internal assets accumulated across Valve’s entire operation during a period of rapid industry change. Such a breach would have been logistically impossible a generation ago; storage density and bandwidth costs have shifted what is practical to leak.

From Launch to Migration

The decade spanned by the leak is not arbitrary. Steam itself launched on September 12, 2003, marking the first date in the archive. The leak ends in September 2013, coinciding with Valve’s transition to new internal storage infrastructure. According to investigator Gabe Follower, the old “Steam2” depot was not migrated to the new system and remained on legacy servers. SteamOS 1.0 launched in December 2013, suggesting the old storage was decommissioned around that time, closing a window that had apparently remained open and vulnerable for months or years.

How the Data Was Accessed

Read also: James Pond Creator Condemns AI Remake as Disrespectful to Series · Xbox Describes Helix as Family of Devices; Elder Scrolls 6 Status Unclear · Phil Collins Returns to Vice City With “Against All Odds” in GTA VI · Pokémon World Championships Struggles With Lottery Demand

Gabe Follower, who first publicized the leak on X, claimed the data was accessed through a publicly accessible endpoint on Valve’s servers. An endpoint in web architecture is a specific URL designed to handle requests and return data—typically protected by authentication tokens or credentials. Publicly accessible in this context does not mean intentionally public, but rather that the endpoint lacked proper authorization controls. The exact mechanism of discovery remains unclear: whether the endpoint was found through systematic scanning, shared in developer communities, or simply stumbled upon cannot yet be determined.

Authorization Failure on Legacy Systems

Endpoints serving legitimate traffic implement authorization checks to verify requests come from authenticated users or applications. If Valve’s endpoint lacked these checks or they could be circumvented, it represents a significant infrastructure oversight. This raises secondary concerns about what other legacy systems might still operate with similar vulnerabilities or remain in use despite insufficient security measures. The ten-year gap between the data’s creation (2003–2013) and its public emergence (August 2026) suggests the vulnerability existed undetected or unexploited for an extended period.

Developer Acknowledgment

Elan Ruskin, a former Valve developer who worked on Half-Life 2: Episode Two, Left 4 Dead 2, Portal, and Portal 2, posted on X earlier today addressing the leaked prerelease builds. His message was direct: every good idea from those games made it into the final shipped versions, and anything absent from release was discarded because it was not worth pursuing. Ruskin’s statement acknowledges the leak without requiring extensive official commentary from Valve’s communications team. It also signals developer perspective—prerelease material represents dead ends and abandoned directions, not hidden quality waiting for discovery.

The choice to have a former developer respond publicly, rather than having Valve issue a denial or hold statement, suggests internal recognition that the leak is genuine and that attempting to suppress discussion would prove futile. No official statement from Valve has been released as of publication.

Verification and Misinformation

Community members have begun cataloging the leaked data on GitHub, creating searchable indices of confirmed contents. This crowdsourced approach allows researchers to verify what genuinely exists in the archive versus what remains speculation. Portal 2 and Left 4 Dead 2 beta builds have been confirmed and are playable, with gameplay videos already surfacing online. However, many claims circulating on social media remain unconfirmed, particularly regarding Half-Life content and the existence of Half-Life 3 development materials.

The Half-Life 3 Problem

The Half-Life fan community has speculated about a potential sequel for over 16 years. The appearance of a massive Valve leak has reignited theories that evidence of Half-Life 3 might finally surface. Gabe Follower himself issued a warning that such claims should be treated with extreme skepticism—taken “with an extra carton of salt” for the coming weeks. A build folder labeled “EP3” does not confirm that Half-Life 3 entered active development, only that the label existed at some point. Many archived builds represent experiments, prototypes, and abandoned directions that never advanced beyond early stages.

The Research Timeline

Weeks of investigation lie ahead as researchers process the data systematically. GitHub’s role in organizing information has prevented the release from dissolving into chaos. Researchers are documenting file structures, build dates, version numbers, and relationships to establish what each archive represents. This process will likely reveal canceled projects, abandoned features, and development directions that never reached public awareness before the leak exposed them.

What Comes Next

The leak represents a complete infrastructure vulnerability from over a decade ago, but raises questions about current security practices at major publishers. Valve has not announced any investigation into the breach’s origins or any corrective action. The gaming community’s research will continue, and major findings will emerge as the catalog expands. Until then, every claim about Half-Life, cancelled sequels, or scrapped features should be met with the skepticism Follower and Ruskin have advocated for.