F5 Poker. Everything Poker. Always Refreshing.

AceGuardian Research has released an open-source toolkit intended to help online poker operators identify superusers from completed no-limit hold’em hand histories. The MIT-licensed package includes a technical playbook, Python and data pipeline, screening tools, hand-level tests, a Bayesian range model, an equity engine and an anonymized case study.

The repository is built for hand histories where an operator knows every player’s hole cards. Operators can run it on their own data, while players can submit hand histories to QuintAce for analysis and operators can submit them to AceGuardian. The project is specifically aimed at superusing, and AceGuardian says bots and collusion require dedicated models.

The system evaluates hands after they finish, comparing a player’s actions with their actual cards, the opponent’s actual cards and a predicted opponent range based on historical play. Its core test asks whether a player’s folds and calls remain unusually dependent on an opponent’s hidden cards after equity against that predicted range is accounted for.

Population screening looks for unusual win rates and playing styles over adjustable periods, and can cluster accounts. Other signals include “oracle folds,” successful low-equity bets and outlier bluff-catching. Flagged hands receive a 0-to-100 risk score based on the decision, hand strength, pot size and timing, although timing is optional as a screening signal because players naturally act at different speeds.

The system does not automatically ban accounts. It produces a player score and a ranked list of suspicious hands for expert review, and a case is only flagged when multiple signals agree across many hands. John Andress, AceGuardian’s head of game integrity, said the aim was to keep a human involved in the final decision.

A reviewed $25/$50 heads-up case showed why win rate alone may not identify suspicious play. The suspect played 757 hands over 10 weeks, won about $45,000 and recorded no losing sessions across 14 meetings. Their best 720-hand win-rate run ranked only around the 81st percentile among 2,010 comparable players, below a top-10% threshold, but the basic model flagged 72 hands and placed the player in the top 1% on six signals among 193 comparable heads-up players.

The GitHub repository contains a slightly different, 718-hand anonymized sample. It says the published 757-hand population figures cannot be reproduced from the bundled data. In simulator testing, the range-adjusted screen found planted superusers using hidden information on all or half of their decisions, but not those using it on a quarter of decisions. Among 285 simulated honest players, the decision-signal screen flagged none, while win rate alone flagged 26. Those are simulator results rather than real-world detection rates.

AceGuardian says it has operated anti-cheat systems since 2019 across seven platforms, checking tens of millions of decisions daily. On one operator’s games, it said a 32-core node processed a median 26.8 million postflop decisions a day in roughly 3.4 hours.

The release followed disclosure of a remote-access agent distributed through compromised versions of Jurojin Poker and IntuitiveTables. According to AceGuardian’s account, the intrusion gave an attacker access to players’ screens, files, keyboards and mice, allowing hole cards to be read from players’ devices rather than poker-site servers. The company argues that platform-side detection can still work regardless of how the hidden information was obtained, because exploiting it creates measurable decision patterns.

The launch also arrives after concerns over the Paul Gregg account, whose suspicious activity had generated warnings at poker sites before the allegations became public, as we reported in September.