Most extortion in security starts with a breach. A campaign aimed at small game developers doesn't bother. The threat is simpler: pay up, or we use AI to copy your game and release it before you do.
What is happening
According to Risky Business News, for several months unidentified senders have been emailing small game studios and threatening to clone their public demos and unreleased games with AI tools, then publish the copies first, unless a ransom is paid. Demands have ranged from hundreds to thousands of US dollars.
Some of these emails have surfaced publicly on Reddit's indie developer community and on X in recent weeks. The campaign is believed to be the main reason many developers have started pulling their demos from Steam.
It is not clear whether the people sending the emails can follow through. Developers are taking it seriously anyway, and they have reason to.
Why the threat is credible
Over the past few months there have been several cases where small games that broke through and got popular were copied with AI and released within days. Risky Business cites Needle In A Haystack and Escape the Walls, and 404 Media documented other cases in July.
That history is what makes the threat work. The attacker doesn't have to prove anything, because the victim has already seen it happen to other studios.
Valve's response
Speaking at a conference in South Korea, Valve executives addressed both the cloning and the extortion. They called the emails a matter for law enforcement. They also said simple games will always be targets, and advised developers to avoid games built around a single easily copied mechanic. Their view is that a more complex, higher-quality game can't be copied in a day and is easier to defend in court.
The broader pattern
What's new here is that the extortion runs entirely on how cheap AI has made copying. Nothing is breached and no data is stolen. The leverage is time to market, and a public demo is all the attacker needs.
This isn't only a gaming problem. Any company that shows a product before it ships, through a demo, a beta or a public sandbox, is giving away the raw material for the same threat. The questions to ask are the usual ones. What do you expose before launch? How fast can you prove the work is yours? Do you know who you'd report to before the email lands?
Pulling demos makes sense in the short term, but demos are how small developers get noticed. So a cheap, believable threat ends up costing the whole indie scene, whether or not anyone ever makes a copy.
Source: Risky Business News: Game devs are being extorted with AI game-cloning threats
