Steam API Leak Exposes Unannounced Games Including Sonic and Dune

A configuration error on Valve's Steam platform has exposed achievement data for a wide array of unannounced video games. This leak allows third-party tracking sites to reveal project details that publishers intended to keep secret until official announcements. Gamers and industry watchers can now see the scope of Valve's upcoming catalog without waiting for press releases.

Third-party trackers scan public endpoints to reveal secret project details

The exposure occurred because the Steam API made achievement lists accessible to public tools despite the games not being publicly listed on the store. Third-party trackers like Exophase and SteamDB scanned these accessible endpoints and compiled the data. The incident highlights how backend API permissions can inadvertently leak sensitive development information.

Confirmed titles in the leaked data include projects for the Avengers, Dune, Sea of Thieves, Sonic, Stellaris, Twin Peaks, and The Walking Dead franchises. The list also confirms Squadron 42 is slated for a Steam release, contradicting recent reports that pushed its launch to Q2 2027. Additionally, the leak lists Persona 6, Kingdom Hearts IV, and ACE COMBAT 8, alongside various remasters and sequels.

Mike Bendel, the owner of Exophase, stated that the site simply scanned games with achievements that should have been private. He attributed the exposure to a potential misconfiguration on Valve's end rather than a malicious hack. The data does not include Grand Theft Auto 6, which dispels rumors of an imminent PC launch for that title.

A leaker named ForwardLeaks suggested that the unannounced Avengers game might be the long-dead THQ project that was somehow resumed. Bendel advised taking this specific claim with a heavy grain of salt as it remains unverified. The incident serves as a reminder of the fragility of pre-launch secrecy in digital distribution platforms.