Following recent developments in a high-profile “superuser” scandal, where a remote-access Trojan hidden in tampered poker software exposed players’ screens and hole cards, a new open-source anti-cheat playbook has been released to help prevent any future repeat of the situation.
AceGuardian Research by A5 Labs has published its entire code repository on GitHub with the goal of allowing any online poker operator or researcher to run automated superuser detection on their existing hand histories.
AceGuardian has run anti-cheat systems for online poker operators since 2019 and now works with seven platforms, detecting collusion, bots, real-time assistance (RTA) and superusers across tens of millions of decisions a day.
They also accept hand history submissions from operators or individual players to run directly through its detection models. Simply reach out to [email protected] for more details.
The Incident: Explained
The situation first arose last month, with accusations of a remote-access agent being planted on players’ computers via compromised poker software.
This allowed the attacker to remotely view opponents’ screens and hole cards, affecting over two dozen high-stakes online poker players.
It quickly transpired that Jurojin Poker, along with IntuitiveTables, were the compromised tools, with Jurojin releasing a statement explaining that through a “highly targeted operation” between June 2025 and June 2026, an attacker was able to replace the updated package with a tampered version.
The attacker had allegedly used this exploit to win money from players on various sites, including GGPoker, with other sites noticing the suspicious play and banning the “superuser”
How to Detect a Superuser
This is where tools like AceGuardian come in, with the ability to evaluate hands post-facto (when all hole cards are known to the integrity system) using several key metrics:
- Equity Comparisons: Measuring whether a player’s decision depends heavily on equity against the opponent’s actual cards once their equity against the perceived range is held constant.
- Oracle Folds: Identifies folds made with hands that are ahead of an opponent’s standard range, but behind their specific hidden hand.
- Bluff Index: Tracks the frequency and success rate of low-equity bets and raises against exact holdings
It also takes into account win-rate outliers, comparing bb/100 against others with similar hand samples, and decision timing where not only are the timings assessed in isiolation, but also against the player’s own baseline.
AceGuardian has made it clear, however, that no single signal is conclusive. A case is only flagged when the signals agree across many hands.
In a heads-up case review submitted following the September 29 incident, even the most basic baseline version of their methodology flagged 72 suspicious hands where a player repeatedly made statistically impossible or hyper-optimal decisions against precise holdings.
Over ten weeks, the Suspect played 757 hands at $25/50, 95% of them heads-up against the Opponent over 14 sessions, and won about $45,000 in those sessions. Half the sessions lasted fewer than 30 hands. In the rest, the Suspect won between about $1,800 and $8,800 per session, except for one 250-hand session in which they won about $15,300.
Case Scorecard
| Signal | Value | Percentile | Opponent vs field | Top 10 winners | Median |
|---|---|---|---|---|---|
| Oracle-fold ratio: postflop, pair or better | 90.3% | 100th | 67.7% | 71.2% | 70.8% |
| Oracle-fold ratio: turn | 92.9% | 100th | 66.0% | 71.3% | 69.7% |
| Oracle-fold ratio: river | 91.2% | 99th | 74.4% | 76.5% | 76.7% |
| Fold to value bets | 86.2% | 100th | 57.0% | 56.2% | 53.9% |
| Fold to bluffs | 16.3% | 5th | 28.6% | 27.6% | 26.1% |
| Discrimination gap | 69.9 pts | 100th | 28.3 pts | 28.7 pts | 27.6 pts |
| Bluff success | 39.5% | 99th | 29.2% | 25.5% | 26.6% |
The table shows data comparing the Suspect vs Opponent, as well as heads-up references against the field and the top 10 winners. It also shows the median values of the 25/50 HU population
Call to Action for Operators & Community
The methodology and Python/data pipeline are publicly available on GitHub for operators to implement & run on their hand histories.
They also offer other free services to the community, like tracking the poker industry’s ecology through QuintAce, the new play & learn platform.
AceGuardian is also accepting hand history submissions from operators or individual players to run through their detection models directly. For more information about submissions, reach out to [email protected].
About AceGuardian and QuintAce
Dr. Thanh Tran, founder, CEO & CTO of AceGuardian and QuintAce, is a former computer science professor at the Karlsruhe Institute of Technology and a former Visiting Assistant Professor at Stanford. He also held an executive role at Upwork through its IPO.
John Andress, Head of Game Integrity at AceGuardian, is a former HSNL professional. A founding member of the company in 2019, he leads the team behind its detection methods.
Will Shillibier
Managing Editor