Online poker's integrity problem just got a public toolkit. AceGuardian Research by A5 Labs has published the full code for its superuser detection system on GitHub, allowing operators and researchers to run automated analysis on hand histories. PokerNews reported the release on October 8, 2026, describing it as an effort to help the industry respond to a wave of cheating concerns.
For players, the story is important because it explains how cheaters can be caught after the fact and what safeguards sites should have in place. For operators, it lowers the barrier to building serious anti-cheat programmes.
What Is a Superuser?
In poker, a "superuser" is someone who can see opponents' hole cards. Historically, the term came from insider-cheating scandals on early online sites, where employees or affiliated users exploited privileged access. In the current context, it refers to any player with unfair access to hidden information, including through malware.
The release follows a recent scandal in which a remote-access Trojan, hidden in tampered poker software, exposed players' screens and hole cards. PokerNews reports that more than two dozen high-stakes players were affected, and that Jurojin Poker and IntuitiveTables were identified as the compromised tools. Jurojin said an attacker, between June 2025 and June 2026, swapped an updated software package for a tampered version. The attacker allegedly won money at several sites, including GGPoker, before other sites banned the account. We covered the early fallout in our report on the superuser scandal and site warnings.
How the Detection Method Works
The AceGuardian tools evaluate hands after the fact, when all hole cards are known. That is a critical point: it means the system does not need to catch cheating in real time to be useful. By comparing what a player did with what they could have known, analysts can identify patterns that are statistically implausible.
PokerNews lists several metrics:
Equity Comparisons
The system examines whether a player's decisions depend heavily on the opponent's actual cards rather than on ranges. A normal player makes decisions based on probabilities. A player who sees hole cards will consistently make decisions that are correct against the specific holding. Over many hands, the gap becomes visible. For more on how equity works, see our primer on what is equity.
Oracle Folds
An oracle fold is a fold with a hand that is ahead of the opponent's range but behind their actual holding. Everyone makes the occasional good fold, but doing it with unusual frequency against value bets is suspicious.
Bluff Index
This metric looks at the frequency and success of low-equity bets and raises against exact holdings. If a player bluffs mostly when the opponent's hand is weak and rarely when it is strong, that can indicate knowledge of the opponent's cards. Compare that with honest play described in our how to bluff guide, where bluffs are chosen using range and board texture.
Win-Rate Outliers
Win rate in big blinds per 100 hands is compared with players with similar sample sizes. An extremely high rate is not proof of cheating on its own, but it supports other signals.
Decision Timing
Timing patterns are compared with a player's own baseline, which can reveal changes in behaviour linked to software assistance.
PokerNews stresses that no single signal is treated as conclusive. A case is flagged only when signals agree across many hands.
A Real Case Study
AceGuardian offered an example from a heads-up case submitted after a September 29 incident. A baseline version of the method flagged 72 suspicious hands. The suspect played 757 hands at $25/50 and won about $45,000. Oracle-fold and bluff-success rates were far above the opponent's and the field's. For instance, the suspect's fold-to-value-bets rate was 86.2 percent versus the opponent's 57.0 percent.
That gap is telling. Folding to value bets 86 percent of the time is extremely high, unless you know when the opponent actually has the better hand. Flagging 72 of 757 hands shows the system focuses on a subset of high-signal situations rather than labelling every hand as suspicious.
Who Is Behind It?
AceGuardian has done anti-cheat work for online poker operators since 2019 and now works with seven platforms. Dr. Thanh Tran is founder, CEO and CTO of AceGuardian and QuintAce, and John Andress is Head of Game Integrity and leads the detection team. The company accepts hand history submissions from operators or individual players for analysis, via email. It also offers QuintAce, a free play-and-learn platform that tracks the poker industry's ecology.
Why Open-Sourcing Matters
Publishing the code has several implications.
Transparency. Operators have often been reluctant to reveal detection methods for fear that cheats would adapt. But security specialists generally argue that robust systems shouldn't rely on secrecy. Open code allows peer review and improvement.
Accessibility. Smaller operators may lack the resources to build sophisticated tools. A free repository gives them a starting point, which could raise standards across the industry, including the poker networks that smaller skins depend on.
Research. Academics and independent analysts can test the method on public or simulated data, helping to validate or refine the metrics.
Risk. There is a trade-off: cheaters can read the code too and try to evade detection. The multi-signal approach is designed to make that harder, since evading all signals at once would require playing in a way that sacrifices much of the advantage that cheating provides.
What This Means for Players
Cheating scandals shake trust in online poker. The release of an open tool is a positive sign, but it doesn't remove the need for vigilance.
Choose reputable sites. Licensing, security practices and transparent responses to incidents matter. Our safe poker sites page ranks operators on these criteria, and our reviews of Americas Cardroom, BetOnline and BC Poker discuss security and fairness in more detail.
Keep your device clean. The Jurojin incident involved software that players trusted. Only download tools from official sources, verify updates when possible, and consider isolating poker software from your main device.
Report suspicious play. If you believe you have been the victim of cheating, save hand histories and contact support. AceGuardian says it accepts submissions from individual players too.
Understand the limits. Detection after the fact can result in bans and sometimes refunds, but it cannot undo the loss of trust. Prevention is better than cure.
Industry Implications
Online poker is a smaller market than it was a decade ago in many regions, and trust is a valuable asset. Operators that detect and remove cheats quickly can protect their reputation. Those that fail risk losing players to competitors or to live games. The comparison of online poker vs live poker often comes down to trust: in live poker you can see the cards being dealt, whereas online you rely on the operator.
Regulators will also be watching. If open-source tools become standard, licensing authorities may expect operators to run similar analyses. That could lead to clearer rules on how quickly sites must investigate and disclose breaches.
Final Thoughts
The AceGuardian release won't end cheating, but it makes the cat-and-mouse game fairer. By sharing its methods publicly, the company is betting that collective defence is stronger than proprietary secrecy. Players should welcome the move while staying careful about the software they install and the platforms they trust.