An AI agent investigating a crashed database helped online poker player Alex uncover malware that allegedly captured his screen and enabled control of his computer. The discovery linked the malware to suspicious activity involving an opponent whose results appeared statistically impossible, and to a broader campaign that reportedly targeted hundreds of players and stole millions of dollars.
An AI agent uncovers suspicious software
On September 25, 2026, Alex, a professional online poker player, used a Claude AI agent to examine his playing statistics. Alex agreed to speak to WIRED only under a false name, citing the risk of retaliation from threat actors.
After Alex’s SQL database crashed and had to be reset, Claude’s agents detected something suspicious. A program called MeshAgent was running in the background and appeared capable of capturing Alex’s screen and taking control of his entire computer.
According to the agent’s report, Alex had not installed the program. It had been installed on April 24. Alex said the agent identified 11 timestamped sessions in which the program captured screens, based on graphical errors that appeared during screen sharing.
During the 11th session, Alex continued playing on ACR, or Americas Cardroom, a leading global online poker operator.
A suspicious opponent
Alex reviewed his hand history and found what he considered the most troubling evidence: the same opponent, using the handle OxOO, had been at his table during 10 of the 11 sessions.
The handle was familiar. Alex and several friends in the high-stakes poker community had previously suspected the player of wrongdoing. Alex then checked the player’s winning percentage on a public tracking site. The results were far higher than those of the world’s best players and, given the number of hands played, appeared statistically impossible. In Alex’s view, the evidence showed that the player was cheating.
A wider alleged campaign
In the following days, research by Alex and other members of the high-stakes community reinforced his concerns. Alex was reportedly one of hundreds of players targeted by the same attackers with this type of malware over several years.
Alex, who was the first to discover MeshAgent on his computer, said he lost about $30,000. For a player at his level, that was a relatively moderate amount. Many of his colleagues reportedly lost much more.
With millions of dollars allegedly stolen from major online poker sites, the poker community is demanding answers about how the scheme lasted so long, whether the major operators took the threat seriously after the news emerged, and whether online poker itself has been irreparably compromised.
A longstanding online-poker vulnerability
Cheating has long been a controversy in poker, particularly online. One of the earliest forms of online fraud was the “superuser” technique, in which attackers gain unauthorized access to opponents’ cards and play with complete information about their hands.
Source: www.wired.com
