CS:GO And Team Fortress Source Code Leaked, But Valve Isn't Worried

Valve seemingly has a bit of a leak problem right now, as the source code for both Team Fortress 2 and Counter-Strike: Global Offensive has recently made its way into the public eye. Or at least, that's how it appears. The source code has actually been public knowledge for a while and is only now hitting the mainstream.

If you're unaware of what's going on, here's the short of it: The source code for both Team Fortress 2 and Counter-Strike: Global Offensive seemingly leaked on April 22 through an anonymously posted blog post (by a user only known as Maxx), though the files in question are dated for 2017/2018. Regardless, the leak still represented a possible means for hackers to run a remote code execution and inject malicious code into a player's account.

In response to this leak, several player-run servers temporarily shut down to protect their users. In a blog post, Creators.TF wrote, "Due to the recent source code leak, we are shutting our servers down for the foreseeable future. This is because of the uncertainty surrounding security to our infrastructure as well as your computer. We will monitor the situation and keep you updated." Redsun.TF issued a similar statement, writing in a Steam blog post, "Due to the recent code leaks for both CS:GO and TF2, I have decided to keep all servers offline until a patch is released for potential bugs."

However, in a statement to GameSpot, Valve confirmed that the source code in question actually leaked back in 2018, not April 22, 2020. "We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018," Valve VP of marketing Doug Lombardi told GameSpot.

"From this review, we have not found any reason for players to be alarmed or avoid the current builds (as always, playing on the official servers is recommended for greatest security). We will continue to investigate the situation and will update news outlets and players if we find anything to prove otherwise. In the meantime, if anyone has more information about the leak, the Valve security page describes how best to report that information."

In an attempt to identify Maxx (who remains anonymous), several people pointed fingers at Valve News Network creator Tyler McVicker, citing that the April 22 blog post that revealed the source code included leaked correspondence between McVicker and several of his friends talking about Valve leaks. In response, McVicker held a Twitch Q&A livestream in which he clarified what those leaked conversations were about and establishes how he is not the leaker--a statement further collaborated by Valve Archive curator Jaycie Erysdren on Twitter.

"So for the longest time, I ran a community server team named Lever Softworks," McVicker said during his Q&A. And on Lever Softworks, we did a few things--Portal: Still Alive for PC, Half-Life 2: Aftermath, Half-Life 3 dog resource gathering maps--and behind the scenes we were working on a community recreation of F-STOP based almost entirely on the available assets we had found [and] new information in the retail build of Portal 2." McVicker then goes on to say how the team fell apart, partly because he "got busy" and largely because the team "kept arguing about things." McVicker also talks about a problematic member who was racist and transphobic, which alienated another teammate who was crucial to the project.

On April 21, 2020, McVicker got a call from a long-time friend, who asked if McVicker would be willing to transfer ownership of the Lever Softworks account to them. "I wasn't doing anything with it," McVicker said, "I was busy with Creators.TF." In the process of transferring ownership, the problematic person was removed from the Lever Softworks team and, assuming there would be some form of retaliation in the form of excessive messaging, McVicker preemptively blocked them on social media. "There had been a pattern in the past of this person not being in certain groups or chat rooms and getting very upset about it," McVicker said.

McVicker identifies this problematic person as Maxx--McVicker believes this leak was done out of retaliation for being removed from the team. McVicker added he has no connection to the original 2018 leak either. "I'm not the source of the code, I'm just not," McVicker said. "In fact, I tried very hard to warn Valve about it."

So, all in all, there was no leak--or at least not one on April 22, 2020. The original leak happened back in 2018, and supposedly in an attempt to get back at a perceived slight, a former Lever Softworks team member reposted it alongside some private messages in order to frame McVicker for the deed. Valve has not announced whether it intends to pursue legal action against Maxx or whether this instance will influence its relationship with the Source Engine modding community going forward.