A major security flaw in Indonesia's game ratings board has accidentally leaked significant story spoilers for several unreleased games. The biggest victim is IO Interactive's upcoming James Bond game, 007 First Light, which had over an hour of gameplay footage exposed online including what appears to be the game's ending.

The leak was discovered over the weekend when someone building an alternative frontend for the Indonesian Game Rating System (IGRS) website stumbled upon serious security problems that left private submission materials completely exposed to the public.

How the IGRS Security Flaw Exposed Game Footage

The Indonesian Game Rating System requires developers to submit gameplay footage showing violence, language, sexual content, and other material relevant to age ratings. Developers typically share this footage through private Google Drive links or similar secure methods.

However, a security flaw in the IGRS backend made these private submissions publicly accessible. More than 1,000 games were affected, many of them unreleased titles that developers submitted for classification purposes.

007 First Light ending and story leaked six weeks before release

The leak hits IO Interactive especially hard. Over an hour of 007 First Light footage is now circulating online, including sequences that appear to show the game's ending. This is particularly damaging for a narrative-focused game where story is the main selling point.

007 First Light releases May 27 on PlayStation 5, Xbox Series X/S, and PC. The game tells an origin story for James Bond, showing how he became 007. Actor Patrick Gibson plays a younger, more inexperienced and reckless version of Bond as he takes on an MI6 mission that will grant him 00 status if successful.

The game was already facing some challenges. IO Interactive recently delayed the Switch 2 version from the May 27 launch date to sometime in summer. Now the studio has to deal with major story spoilers spreading across social media more than six weeks before release.

Developer Email Addresses and Contact Information Exposed

Beyond game spoilers, the leak exposed thousands of email addresses belonging to game developers. This includes contact details for high-level staff at major triple-A studios.

While gameplay leaks eventually blow over once games release, exposed personal information creates long-term security and privacy risks for developers. The email addresses could be used for phishing attacks, harassment, or other malicious purposes.

This aspect of the leak may have more serious long-term consequences than the spoiled game footage.

Avoiding Spoilers Until Release

If you're looking forward to 007 First Light or Echoes of Aincrad, be extremely careful on social media for the next several weeks. The nature of social media makes avoiding spoilers difficult, as algorithms can surface content even when you're actively trying to avoid it.

For 007 First Light specifically, the safest approach is avoiding all Bond-related content until after May 27. With over an hour of footage leaked including the ending, spoilers are widespread and likely to pop up unexpectedly.

The leak serves as a wake-up call for both ratings boards and developers about the importance of proper security infrastructure when handling confidential game materials.