News New Open-Source Superuser Detection Software Released to the Public

[Bawse]

Following the recent online poker superuser scandal, QuintAce and its research arm, AceGuardian Technologies, have introduced an open-source tool designed to help poker operators identify potential cheaters.

The software analyzes poker hand histories to detect suspicious playing patterns that could indicate a player has access to opponents' hole cards. Rather than relying solely on unusually high win rates, it examines individual decisions and looks for behavior that would be difficult to explain through normal gameplay.

The system evaluates several factors, including suspicious folds, successful low-equity bets, unusual bluff-catching statistics, and decisions that appear to be influenced by knowledge of an opponent's cards.

How Does It Work?​

The tool automatically analyzes large volumes of poker hands, identifies suspicious accounts, and assigns risk scores to questionable decisions. These results can then be reviewed by human analysts before any conclusions are reached.

According to QuintAce, testing the system on approximately 700 hands from accounts connected to the recent controversy revealed significant statistical anomalies across multiple detection categories.

The software is being released under the MIT open-source license, allowing online poker operators and researchers to implement and adapt it without licensing fees. Players can also submit suspicious hand histories directly to AceGuardian for analysis.

QuintAce hopes the release will encourage greater transparency and help the industry combat cheating across multiple poker platforms.

Although this technology could be a significant step toward protecting online poker players, its effectiveness will ultimately depend on whether operators adopt it and take suspicious activity seriously.

What Do You Think?​

Could open-source detection tools like this help restore trust in online poker, or will cheating remain a major problem as long as operators are reluctant to share information about suspicious players?

Source: https://www.poker.org/latest-news/q...eapon-against-online-superusers-amRxw5Y1wKno/

 

[Cpvr]

Following recent developments in a high-profile "superuser" scandal, where a remote-access Trojan hidden in tampered poker software exposed players' screens and hole cards, a new open-source anti-cheat playbook has been released to help prevent any future repeat of the situation.

AceGuardian Research by A5 Labs has published its entire code repository on GitHub with the goal of allowing any online poker operator or researcher to run automated superuser detection on their existing hand histories.

AceGuardian has run anti-cheat systems for online poker operators since 2019 and now works with seven platforms, detecting collusion, bots, real-time assistance (RTA) and superusers across tens of millions of decisions a day.

They also accept hand history submissions from operators or individual players to run directly through its detection models. Simply reach out to [email protected] for more details.

The Incident: Explained​

The situation first arose last month, with accusations of a remote-access agent being planted on players' computers via compromised poker software.

This allowed the attacker to remotely view opponents' screens and hole cards, affecting over two dozen high-stakes online poker players.

It quickly transpired that Jurojin Poker, along with IntuitiveTables, were the compromised tools, with Jurojin releasing a statement explaining that through a "highly targeted operation" between June 2025 and June 2026, an attacker was able to replace the updated package with a tampered version.

The attacker had allegedly used this exploit to win money from players on various sites, including GGPoker, with other sites noticing the suspicious play and banning the "superuser"

How to Detect a Superuser​

This is where tools like AceGuardian come in, with the ability to evaluate hands post-facto (when all hole cards are known to the integrity system) using several key metrics:

• Equity Comparisons: Measuring whether a player's decision depends heavily on equity against the opponent's actual cards once their equity against the perceived range is held constant.
• Oracle Folds: Identifies folds made with hands that are ahead of an opponent's standard range, but behind their specific hidden hand.
• Bluff Index: Tracks the frequency and success rate of low-equity bets and raises against exact holdings

It also takes into account win-rate outliers, comparing bb/100 against others with similar hand samples, and decision timing where not only are the timings assessed in isiolation, but also against the player's own baseline.

AceGuardian has made it clear, however, that no single signal is conclusive. A case is only flagged when the signals agree across many hands.

In a heads-up case review submitted following the September 29 incident, even the most basic baseline version of their methodology flagged 72 suspicious hands where a player repeatedly made statistically impossible or hyper-optimal decisions against precise holdings.

Call to Action for Operators & Community​

The methodology and Python/data pipeline are publicly available on GitHub for operators to implement & run on their hand histories.

They also offer other free services to the community, like tracking the poker industry's ecology through QuintAce, the new play & learn platform.

AceGuardian is also accepting hand history submissions from operators or individual players to run through their detection models directly. For more information about submissions, reach out to [email protected].


Source: https://www.pokernews.com/news/2026...tection-software-released-to-public-52549.htm

 

[Bawse]

This superuser scandal is a serious reminder of how important security is in online poker. What makes this case especially concerning is that the attacker allegedly gained access to players' hole cards through compromised third-party software, rather than exploiting the poker site's software directly.

In its response to PokerNews, Jurojin Poker stated:

"Wolf deserves all of the credit. He discovered the attack and has led the investigation from the start."

Jurojin also explained that it had introduced additional security measures, including stronger internal security validations, to help prevent similar attacks in the future.

I think this situation raises questions about the responsibility of both poker rooms and third-party software developers. Players trust these tools to help them manage their games, and compromised software can put that trust, their privacy, and potentially thousands of dollars at risk.

Poker rooms also need to investigate suspicious accounts promptly, especially when multiple players report unusual activity. If players are cheated, the sites should take responsibility for investigating the affected hands and determining whether refunds are warranted.

What do you think? Should poker sites take greater responsibility for monitoring third-party software used by their players, or should that responsibility fall primarily on the software developers?

Source: PokerNews — Compromised Poker Software on Superuser Scandal: 'We Are Truly Sorry'

https://www.pokernews.com/news/2026/10/jurojin-speaks-after-superuser-scandal-52575.htm