Last Updated on October 9, 2026 by Bala Kumar
Online poker just got a free, public weapon against “superusers.” On October 8, 2026, AceGuardian Research by A5 Labs published its full superuser-detection code on GitHub, so any poker operator or researcher can scan their own hand histories for players who seem to see hidden cards.
The release lands barely ten days after a malware scandal rattled high-stakes online poker. Here is what happened, how the new tool works, and what the numbers from its first public case study show.
The superuser scandal that triggered it
A hidden remote-access program, slipped into trusted third-party poker tools, let an attacker watch victims’ screens and hole cards. This was not a poker site being hacked: the breach came through software players installed themselves.
| Date | What happened |
| Oct 8, 2026 | AceGuardian open-sources its superuser detection pipeline. |
| Early Oct 2026 | Reports say at least two sites had been warned about the suspect account; one acted over two years earlier, and a coach flagged it to GGPoker in September. |
| Oct 1, 2026 | Jurojin Poker confirms an attacker swapped its update package for a tampered build between June 2025 and June 2026. |
| Sep 29–30, 2026 | A cybersecurity researcher on X reports a covert remote-access agent on players’ Windows PCs, with about 30 high-stakes players affected. |
The two compromised tools were Jurojin Poker and IntuitiveTables. The same actor also reportedly ran phishing sites that imitated poker rooms and popular poker tools.
Superusing is not new. The term dates back to the UltimateBet and Absolute Poker scandals of 2005–07, but CardPlayer notes this appears to be the first case of a player using third-party software to get inside opponents’ computers.
What AceGuardian released
The full methodology plus a Python data pipeline, free on GitHub, built to run on hand histories an operator already has.
• Code: superuser_detection_poker on GitHub
• Write-up: QuintAce blog post on the open-source release
• Who’s behind it: AceGuardian has run anti-cheat for online poker operators since 2019. It now works with seven platforms, screening for collusion, bots, real-time assistance (RTA) and superusers across tens of millions of decisions a day.
• Leadership: founder and CEO/CTO Dr. Thanh Tran, a former computer science professor at the Karlsruhe Institute of Technology and visiting assistant professor at Stanford; and John Andress, Head of Game Integrity and a former high-stakes no-limit pro.
• Free review: operators and individual players can also submit hand histories for AceGuardian to run through its models.
How the detection works
The system reviews hands after the fact, once every player’s hole cards are known, and asks one question: does this player act as if they can see cards they shouldn’t?
| Signal | What it looks for |
| Equity comparison | Whether decisions track equity against the opponent’s actual hand, even when equity against their likely range is held constant. |
| Oracle folds | Folds of hands that beat the opponent’s normal range but lose to the specific hidden holding. |
| Bluff index | How often, and how successfully, low-equity bets and raises are fired at exact holdings. |
| Win-rate outliers | bb/100 compared with players on similar sample sizes. |
| Decision timing | Speed of decisions, judged on its own and against the player’s personal baseline. |
No single signal is treated as proof. A player is flagged only when several signals point the same way across many hands, which keeps strong but honest players from being caught in the net.
The case study: a superuser in numbers
Even the simplest version of AceGuardian’s method flagged 72 suspicious hands in a heads-up case submitted after the September 29 disclosure. Over ten weeks, the suspect played 757 hands at $25/50, almost all (95%) heads-up against one opponent across 14 sessions, and won roughly $45,000.
| Signal | Suspect | Median 25/50 HU player | Suspect percentile |
| Oracle folds, postflop pair or better | 90.3% | 70.8% | 100th |
| Oracle folds, turn | 92.9% | 69.7% | 100th |
| Oracle folds, river | 91.2% | 76.7% | 99th |
| Fold to value bets | 86.2% | 53.9% | 100th |
| Fold to bluffs | 16.3% | 26.1% | 5th |
| Discrimination gap | 69.9 pts | 27.6 pts | 100th |
| Bluff success | 39.5% | 26.6% | 99th |
Source: AceGuardian case scorecard, reported by PokerNews, October 8, 2026.
The tell is selectivity. Honest strong players fold to value bets and to bluffs at broadly similar rates because they can’t tell them apart; this player folded almost every time they were beaten and almost never when they were being bluffed. Half the sessions ran under 30 hands, and the rest typically netted about $1,800 to $8,800, with one 250-hand session worth about $15,300.
What it means for players and operators
Open-sourcing turns superuser detection from a paid, closed service into a shared baseline any room can run. Smaller operators without in-house security teams now have a starting point, and the community can audit how a “cheater” is defined.
For operators: run the pipeline on existing hand histories, especially heads-up and high-stakes tables, where this attack concentrated.
For players:
• Treat third-party poker tools like any software with deep access to your PC. Keep them updated only through official channels.
• Watch for phishing sites that mimic poker rooms and tool vendors.
• If a heads-up opponent seems to read your exact hand, save your hand histories and report them to the site, or submit them for independent review.
FAQs
What is a poker superuser?
A player who can see opponents’ hidden hole cards, through an insider exploit, a software flaw or, in this case, malware on the victim’s computer.
Is AceGuardian’s tool free?
Yes. The code and methodology are public on GitHub.
Can one bad session get me flagged?
The method is designed against that: a case is raised only when multiple signals agree over a large sample.
Were poker sites themselves hacked?
No. The compromise was in third-party tools (Jurojin Poker and IntuitiveTables), not in poker room software.
Founder of PokerClubGames.com and a Poker Researcher with 10+ years of experience in SEO, WordPress development, and gaming content strategy. Specializes in researching online poker sites, poker apps, tournaments, bonuses, and poker strategies. Experienced in poker platform reviews, affiliate marketing, and creating SEO-focused poker content for global audiences.
For collaborations, media inquiries, or poker-related partnerships:
Contact: partnerships@pokerclubgames.com
