After a compromised software attack gave a poker cheat access to opponents’ screens and hole cards, a new tool is asking a harder question: can suspicious decisions be spotted after the cards are dealt?
AceGuardian Research has made its superuser detection code public, giving poker operators and researchers a way to examine hand histories for patterns that may point to hidden information.
The release matters because the recent scandal was not simply about a player making unusually good reads. A remote access Trojan, known as Mesh, was placed on affected computers through tampered third-party software. Our coverage of the Jurojin poker superuser attack and the 92 malicious update attacks explained how the compromise allegedly worked. AceGuardian’s code addresses a different part of the problem: finding evidence in the decisions that followed.
The reporting developed in stages. Our September 29 account set out the original poker Trojan allegations, while the September 30 follow-up examined the estimate of potentially affected players. Jurojin’s confirmation and technical breakdown, linked above, then addressed delivery of the compromised updates. This article focuses on a different problem: what hand-history analysis can establish after play.
How hand-history analysis can expose a superuser
In an ordinary poker hand, a player chooses an action using incomplete information. They estimate an opponent’s likely range, then decide whether to bet, call or fold. A player who can see the opponent’s actual cards has a very different information set, and that gap can leave a statistical trace across many hands.
AceGuardian says its system tests for several patterns rather than relying on one suspicious move. Its published methods include comparing decisions against an opponent’s actual holding and their likely range, identifying “oracle folds” where a player repeatedly lets go of hands that beat an opponent’s normal range but lose to the exact hand, and assessing bluffing patterns against known cards. The analysis also considers win-rate outliers and decision timing against the player’s own baseline.
That last comparison matters. A player who acts quickly is not automatically cheating, just as a winning session does not prove a player saw their opponent’s cards. The stronger question is whether a player’s decisions repeatedly change in ways that make sense only when judged against information they should not have had.
Why one strange hand proves very little
Poker is a game of variance. Players make unconventional folds, catch unlikely bluffs, and run far above expectation for short stretches. Even a seemingly perfect decision can have a legitimate explanation, such as a read on an opponent, a strategic adjustment or a mistake in the recorded data.
For that reason, AceGuardian says no single metric is conclusive. A case is only flagged when the signals agree across many hands. In a heads-up case review, the company said its baseline methodology flagged 72 suspicious hands among 757 played over ten weeks. That is statistical evidence to investigate, not an independent finding that a player was guilty.
A flag is a starting point. Investigators still need to check the underlying hands, confirm that the records are complete, consider alternative explanations and give the accused player a fair process. The tool can help narrow the search; it cannot tell a poker room why a decision was made or replace a careful integrity review.
The data access problem players should understand
There is a practical limit that is easy to miss: useful superuser analysis needs reliable hand data, including cards that opponents normally never see. A poker room can access the cards and action recorded on its own servers. A player’s downloaded hand-history file may contain less information, particularly for hands that ended without a showdown.
This means publishing code does not make a plug-and-play detector available to every player. Operators need to prepare compatible records, run and interpret the analysis, and decide how to handle its results. Independent researchers may be able to test the methods, but their conclusions depend on what data they can lawfully access and how complete that data is.
AceGuardian says it will also accept hand-history submissions from players or operators for analysis. That may help with individual cases, but it does not replace routine monitoring by the poker rooms that hold the full records. Players should also be cautious about sharing account details, private hand data or identifying information without checking who will receive it and how it will be used.
What poker rooms still have to do
Open-source code can make scrutiny easier. Researchers can inspect the methodology, test it against other datasets and suggest improvements. Operators can compare their own systems with a public approach instead of asking players to trust that an unspecified security team is looking for unusual play.
But detection is only one layer of security. The recent attack began with compromised software on players’ computers, so poker rooms and third-party tool makers also need strong update controls, clear incident reporting and a way to contact users who may have been exposed. Rooms must preserve relevant hand and account records, investigate credible reports promptly, and explain what action they take when they find evidence of cheating.
Players who suspect they were targeted should keep session dates, screen names, hand histories and any security notices they received, then report the concern through the operator’s official channels. They should avoid publicly naming someone as a cheat based only on a strange hand or a statistical flag. Our guide to what happens when a poker site catches a cheater looks at why investigations, account action and player remedies are separate parts of the process.
Can open-source software restore trust?
It can contribute, but it cannot restore trust on its own. AceGuardian’s release gives the poker industry another tool to examine suspicious play, and making the code public creates an opportunity for outside scrutiny. The value will depend on whether poker rooms adopt it, test it properly and publish enough about their integrity work for players to judge the response.
The central lesson is that statistical detection can help show when a player’s decisions appear inconsistent with ordinary poker. It cannot by itself prove how that player obtained an advantage, identify every affected account or guarantee that a room will return losses. The code is a useful opening move. The real test is what operators do with the evidence.
