Response to the Trojan Horse Scandal
The release of this security tool came as a direct response to a dangerous scandal in September. During this incident, a Trojan horse, MeshAgent, was discovered in compromised versions of popular poker tools (Jurojin Poker and IntuitiveTables). This allowed an attacker to access the screens and exact cards of more than two dozen high stakes players across Europe and North America.
As emphasized by the tool's creators, the poker platforms' servers themselves were not breached, and the card leaks occurred directly from the victims' personal computers. Utilizing this information at virtual tables leaves unmistakable statistical traces in game decisions, which the system can identify regardless of how the attacker obtained the data.
This unique system is the brainchild of an important duo. Dr. Thanh Tran, founder, and CEO/CTO of QuintAce and AceGuardian, was also a professor of computer science at the Karlsruhe Institute of Technology and a researcher at Stanford University. John Andress is the head of game integrity at AceGuardian and a former high stakes NLH professional.
The AceGuardian team has managed anti-cheating systems since 2019 for seven international platforms and evaluates tens of millions of decisions daily.
How the Tool Works: Six Key Signals of Suspicious Behavior
The system works by analyzing played hands when the security system has complete information on all players' cards at the table. Instead of relying on a single indicator, it combines several sophisticated statistical metrics:
-
Equity Comparison: A player's decisions are compared against three levels: against the entire possible combination spectrum, against actual opponent cards, and against an estimated range from a Bayesian model. The test examines whether the player's reactions are abnormally dependent on the exact hidden opponent cards even after considering standard strategy.
-
Oracle Folds: Identifies situations where a player folds a strong hand (e.g., top pair or two pairs) that is ahead against a typical opponent range but behind against an opponent's exact hidden hand.
-
Bluff Index: Tracks the frequency and success of bets with very low equity against specific opponent combinations.
-
Bluff Catching: The counterpart to Bluff Index. Measures the ability to call opponents' bluffs.
-
Success Rate: Analyzes results compared to players with a similar number of hands played and playstyle.
-
Decision Time: Monitors the speed of action in specific situations, such as correctly folding a strong hand in a massive pot within 2 seconds.
The system's output does not automatically ban players. The software assigns a risk score from 0 to 100 to suspicious hands and generates a ranking for human review. An account is flagged only when multiple warning signals match across a large sample of played hands.
Case Study 'Paul Gregg': Why Win-Rate Alone is Not Enough
To demonstrate the tool's effectiveness, the creators published a real case study related to the incident known as 'Paul Gregg'. The analysis focused on a sample of 757 hands played over 10 weeks at 25/50 limits, mostly in heads-ups. The suspect won approximately $45,000 in these duels and didn't experience a single losing night.
If the platform evaluated the player based solely on his bb/100 win rate, the suspect would have successfully blended in with the crowd. His best winning streak reached the 81st percentile among 2,010 comparable players, reflecting a typical good run for a strong professional.
Only the application of the new decision model revealed the brutal reality:
-
The basic model flagged 72 suspicious hands.
-
The player ranked in the top 1% extremity across six key signals out of 193 compared heads-up players.
-
Repeatedly exhibited extremely quick folds in spots where he was narrowly beaten (including with a hand like A-A).
Availability for Both Platforms and Players
Publishing the source code on GitHub under the MIT license means any online poker operator can implement this detection system into their infrastructure for free.
Additionally, the research team considered the poker community itself. Players who suspect their computer has been compromised or that they've faced opponents with illicit access to hole cards can send their hand history directly for free analysis to research@aceguardian.co.
This code's creation marks a significant milestone for online poker security. It also sends a clear message that while attackers may find new ways to see hidden cards, statistical traces at virtual tables will eventually expose them.
Sources: QuintAce
