Alex is a professional online poker player. On Sept. 25, he opened his Claude agent to review a session of hand histories. The agent flagged something first. A program called MeshAgent was running quietly in the background1.
Someone else had put it there, back in April. Alex found that out from the agent's own report1.
A Stats Check Becomes a Security Report
Claude builds its answer from what a user asks it to check. Alex asked his agent to review play statistics, the kind of session any serious player runs after a long night1.
The agent returned something past that assignment. It found graphical glitches tied to screen capture, timestamped eleven of them, and matched each one to a session on Americas Cardroom1. The same opponent sat at his table for ten of those eleven hands.
Alex lost close to $30,000 to the pattern his agent found1.
A Remote-Access Tool Built for IT Departments
MeshAgent runs on MeshCentral. IT departments use that open-source software to reach a laptop from across a building or a continent4.
A hacker turned that same reach against the players who trusted it. Jurojin and IntuitiveTables are two programs serious players run to manage several tables at once. Both carried the hidden program to new machines through their own update channels4.
That kind of compromised update looks identical to a normal one. Players had reason to trust a file their own software just downloaded1.
The scheme touched six platforms in total. Jurojin and IntuitiveTables served as the entry points. Americas Cardroom, GGPoker, CoinPoker and ClubWPT Gold were the poker rooms where flagged accounts played14.
A cybersecurity researcher confirmed the mechanism on Sept. 29, four days after Alex's agent caught it. The researcher publishes under a handle, instead of a legal name1. That write-up matched MeshAgent to a hard-coded list of usernames. It compared a victim's account name against that list and acted only on a match.
That selectivity explains the years. A tool that misbehaves for every user draws attention fast. One that singles out 10 to 30 chosen targets, spread across three continents, draws scant attention. The researcher traced a cruder version of the same approach back to 20221.
Players Warned Sites for Years
Patrick Howard runs the poker-coaching company Mobius Poker. In early September he sent GGPoker a formal report. He had charted an account with wins far outside the normal range1.
"I found multiple three- to four-standard-deviation outliers," Howard said1. GGPoker told him the evidence fell short of conclusive, and the account kept playing.
"They confirmed multiple times that they looked at my report, but for whatever reason they didn't act on it," Howard said1.
Patrick Leonard, another professional, traced the warnings back further still. "A group of around 100 regs came together and told those sites starting a couple years ago what they suspected with very good details," Leonard said2.
John Andress runs game integrity at A5 Labs, the cybersecurity firm behind anti-cheat services for ClubWPT Gold and other rooms. "Players are frustrated, because they had been reporting this for a year. A few of the platforms just completely ignored them," Andress said1.
One player's own losses show the stakes plainly. Ignacio Morón, a Spanish professional, described a single session against the same pattern of play. "I started playing heads-up with him and in a matter of 15 minutes he wiped out about $60,000 from me," Morón said2. CoinPoker, a separate room, later confiscated more than $100,000 from a linked account and returned the money to affected players.
One 15-Minute Hand Cost a Player Twice Alex's $30,000
Confirmed dollar losses and refunds tied to the MeshAgent scheme
Each column is one dollar figure tied to the scheme: gray columns are player losses, and the magenta column is CoinPoker's confirmed refund.
Each figure traces to a different player or platform, so each column stands apart from one running total.
Sources: WIRED [1]; PlayUSA [2]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| CoinPoker's refund | $100,000 |
| One 15-minute hand | $60,000 |
| Alex's total loss | $30,000 |
WIRED@WIREDIllicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables. https://t.co/fQQVXPz53C
A Targeted Operation, Jurojin Says
Jurojin answered a narrower charge than the one critics raise about the industry as a whole. In a statement, the company called its own breach contained. "This was a highly targeted operation, not a mass attack. It was carried out by a known cheater aiming at specific opponents, mostly at high stakes, with the goal of viewing their hole cards remotely," the company said2.
That framing fits Jurojin's own software. It leaves out the six platforms the scheme crossed. Regulars spent years flagging the same account before anyone caught the mechanism behind it. One player's agent caught it anyway, by chance, five months after the program first appeared on his machine1.
GGPoker announced new protections, including a win-rate anomaly check, on Oct. 15, sixteen days after the mechanism went public1. Americas Cardroom answered differently. Its email to players on Oct. 18 said its security team cleared the games and left refunds off the table.
GGPoker Took 16 Days to Act Once MeshAgent Went Public
Dated steps from the first formal report to each platform's public response, Sept. to Oct. 2026
Each pin is one dated step on a rail spaced by real time; the gap between the public write-up and GGPoker's fix runs 16 days.
Source: WIRED [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Sept. 2026 | Howard's GGPoker report. Patrick Howard flags a statistical outlier account to GGPoker |
| Sept. 25, 2026 | Claude flags MeshAgent. Alex's agent catches the hidden program during a routine stat review |
| Sept. 29, 2026 | Mechanism goes public. A researcher's write-up confirms MeshAgent's reach across platforms |
| Oct. 15, 2026 | GGPoker announces fixes. New win-rate anomaly checks and a ban on third-party tools |
| Oct. 18, 2026 | ACR clears its games. Americas Cardroom calls its review clean and skips refunds |
What to Do
Check any multi-table or hand-tracking program for a background process unfamiliar to you. Jurojin and IntuitiveTables each published a scanner for MeshAgent once the mechanism went public. Run one before your next session1.
Ask your own room directly whether it will refund confirmed losses, and get the answer in writing. CoinPoker's refund followed a formal appeal process. Americas Cardroom's October email promised the opposite12.
By the Numbers
- $1.5 million to $4 million: the range investigators estimate the hacker took from targeted players across platforms1.
- $30,000: Alex's own confirmed loss to the scheme1.
- $60,000: the amount Ignacio Morón says he lost in a single 15-minute session2.
- $100,000 and up: the account CoinPoker confiscated, then refunded to affected players2.
- Eleven: the screen-capture events Alex's Claude agent flagged in his own hand history1.
- Five months: the gap between MeshAgent's install on Alex's machine and the day his agent caught it1.
- 16 days: how long GGPoker took to announce fixes once the mechanism went public1.
- 2022: the year a researcher traced a cruder version of the same attack1.
What to Watch
Watch the refund numbers. CoinPoker published its own. Americas Cardroom's October email offered the clean-review line instead, and skipped a payout1. The researcher's scanner could still turn up MeshAgent on rooms this reporting left out, since the same hard-coded list could reach further.
Sources
- "A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards," WIRED, Oct. 29, 2026, https://www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/
- Blaise Bourgeois, "Super User Scandal Rocks Poker, Cheats High-Stakes Players Out of Millions," PlayUSA, Oct. 9, 2026, https://www.playusa.com/news/super-user-scandal-rocks-online-poker-community/
- Anna Washenko, "Hacker may have stolen millions in a malware attack against online poker players," Engadget, Oct. 29, 2026, https://www.engadget.com/2301500/hacker-may-have-stolen-millions-in-a-malware-attack-against-online-poker-players/
- Philip Conneller, "Online Poker Hit by Malware Scheme Exposing High-Stakes Hole Cards," Casino.org, Oct. 5, 2026, https://www.casino.org/news/online-poker-hit-by-new-superuser-scandal-as-malware-exposes-players-hole-cards/