alternatively, you can make a new user account for him in Windows (if that is what you are using) and turn on parental controls and customize them to your liking. Password the other accounts.
When you do set up filters he'll know you know. I assume you didn't walk in on him
Your other option is to let it go and let his parents deal with it.