// WIRED US/UK — INTELLIGENZA ARTIFICIALE
A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards
In a fitting sign of the times, the hacker’s carefully laid plans were foiled by an AI agent.
It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics. (Alex only agreed to speak with WIRED under a pseudonym to avoid any risk of reprisals from threat actors.) After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine.
Thanks to the Claude agent’s report, Alex could see the program had been installed on April 24, and not by Alex himself. Alex says the agent identified 11 time-stamped events when the program had been capturing his screen based on graphic errors it caused during screen sharing instances. During all 11, Alex had been playing a session on ACR, also called Americas Cardroom, a major worldwide online poker operator.
He checked his hand histories and quickly found the most troubling info yet: The same opponent, playing under the handle OxOO, was at his table for 10 of those 11 sessions.
The handle was familiar. Alex and several friends in the high-stakes community had shared suspicions about this player’s behavior in the past. Alex checked the player’s win rate stats via a public tracking site; they were astronomically higher than the best players in the world, a statistical impossibility given the sample of hands played. In Alex’s view, it was glaringly obvious that this player was cheating.
An investigation by Alex and other members of the high-stakes community in subsequent days confirmed his fears—and then some. Alex was one of hundreds of players allegedly targeted with this type of malware by the same reported threat actor across a period of multiple years. Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky.
With millions of dollars allegedly stolen across the biggest sites on the internet, the poker world is searching for answers about how the scheme was allowed to continue so long, whether major sites took the risk seriously after it was reported, and whether online poker itself has been irreversibly compromised.
Poker has never been short on cheating controversies; online poker especially so. The “superuser” method, in which a cheater gains unauthorized access to their opponents’ cards and can therefore act with perfect information against them, was one of the first to show up online.
Two major sites in online poker’s early days, Absolute Poker and Ultimate Bet, served as cautionary tales in the mid-2000s. In separate instances, superuser cheaters were able to gain insider access to the websites and bilk players for millions of dollars. (Much of the loot was refunded to players following an investigation.) Those high-profile incidents led to tightened security measures from many top poker sites.
Another minor superuser incident took place in 2013, when a Finnish high-stakes player said his laptop had been stolen from his hotel room during a European Poker Tour tournament in Barcelona. When the laptop was recovered, it had been infected with malware that allowed a hacker to view his screen remotely. And maybe the most famous superuser scandal of all took place on the live felt: In a story that made it all the way to SportsCenter, a player named Mike Postle was accused of stealing over $250,000 from livestreamed games at Stones Gambling Hall in 2018 and 2019 with the aid of what observers believed to be an alleged accomplice with access to live card data who fed information to Postle’s phone. (Postle denied the accusations, alleging it was “fake news.”)