Malware Allegedly Let Online Poker Cheater See Opponents’ Cards
A poker player’s AI agent detected screen-capturing malware, prompting allegations of a years-long cheating campaign that may have cost players millions.
Hundreds of online poker players were allegedly targeted with malware that let a cheater see their screens, according to WIRED. The reported campaign may have cost players millions of dollars across major poker sites, though the full scale of the losses remains an allegation. A player discovered the software after an AI agent flagged an unfamiliar program running on his computer.
Table of Contents
How the malware came to light
WIRED reported that Alex, a professional player speaking under a pseudonym, was reviewing play statistics with a Claude AI agent on September 25, 2026. After his SQL database crashed, the agent identified MeshAgent running in the background. The program appeared capable of capturing his screen and controlling his computer.
Alex said the agent found that MeshAgent had been installed on April 24 without his knowledge. He identified 11 time-stamped occasions when it appeared to capture his screen; he was playing on Americas Cardroom, also known as ACR, during all 11. His hand histories showed that an opponent using the handle OxOO was at his table in 10 of those sessions. Alex told WIRED he had lost around $30,000.
The alleged route into players’ computers
Alex and other high-stakes players subsequently investigated what WIRED described as an alleged campaign affecting hundreds of people over multiple years. According to WIRED, the attacker compromised IntuitiveTables and Jurojin, third-party programs that help players manage multiple poker games at once. Engadget reported that the attacker used such tools to install MeshAgent on selected players’ machines.
Seeing an opponent’s cards gives a player an unfair advantage known in online poker as “superuser” cheating. WIRED noted that earlier superuser cases involved insider access to poker sites; this reported attack instead targeted players’ computers. Cybersecurity consultant WolfSec told WIRED he believes the same threat actor may have tried a more basic attack on players’ machines as early as 2022. That connection remains his assessment, not a confirmed finding.
Poker sites’ responses differed
Engadget, summarizing WIRED’s reporting, said one poker service had already banned the suspected cheater because of an unusually high win rate and playing patterns. Other platforms provided tools for players to check their computers after the malware was uncovered. Engadget also reported that one company kept the player active despite complaints, said it found no evidence that game outcomes were compromised, and declined to refund losses.
WIRED did not name the alleged cheater, saying the person had not been charged with a crime. The individual did not respond to WIRED’s requests for comment, according to Engadget. The differing platform responses leave players facing unresolved questions about the extent of the alleged losses and which games, if any, were affected.
Sources
This story was compiled by AI from the reports below. Read the originals for the full details.