Claude AI Agent Found MeshAgent on Poker Player’s PC, WIRED Reports
The discovery tied 11 alleged screen-capture events during ACR sessions to a wider dispute over a targeted malware operation.
- A Claude AI agent detected MeshAgent on Alex’s computer while reviewing his poker statistics on Sept. 25.
- Alex identified 11 alleged screen-capture events during ACR sessions, with OxOO appearing in 10 of them.
- WIRED described compromised Jurojin and IntuitiveTables software as routes used to target selected high-stakes players.
- Jurojin says its update-package incident was highly targeted and ended in January, while ACR says it found no compromised game outcomes.
A professional online poker player identified as Alex said a Claude AI agent reviewing his play statistics found MeshAgent running in the background of his computer on Sept. 25. The agent indicated the remote-access software had been installed April 24 by someone other than Alex, and that it could capture his screen and control the machine.
Alex told WIRED that the agent identified 11 timestamped screen-capture events through graphical errors during screen-sharing sessions. He was playing on Americas Cardroom, or ACR, in every one, and an opponent using the handle OxOO appeared at his table in 10 of them.
Alex and other high-stakes players had already been questioning OxOO’s results. Alex said the account’s publicly tracked win rate was far above those of the world’s strongest players and statistically impossible over its sample of hands. He estimated his own losses at about $30,000.
The account appearances do not by themselves establish that OxOO operated the malware or cheated. Winning Poker Network has stressed that identifying remote-access capability does not itself prove a device was compromised or that cheating occurred. ACR said Oct. 18 that its review found no compromised game outcomes or wrongdoing and that it would not issue refunds.
Alex and fellow players concluded the same threat actor may have targeted hundreds of players over several years, with alleged losses across major sites running into millions of dollars. WolfSec, which publicly disclosed the MeshAgent scheme on Sept. 29, believed the attacker was initially conducting reconnaissance and may have tried a simpler method against players as early as 2022.
The suspected operation focused on poker players’ computers rather than poker-site servers. AceGuardian, which published an open-source detection method after the disclosure, said compromised code-signed builds of two legitimate poker utilities could give an attacker live screen access, keyboard and mouse control, and file access. It said the earliest confirmed activity it identified dated to March 2024 and that initial estimates covered up to 30 machines.
The operation used two delivery routes. The attacker allegedly accessed Jurojin’s update system to send MeshAgent through automatic updates. Separately, a compromised Jurojin developer test computer was allegedly used to add malicious code to an IntuitiveTables build before the developer signed it; the altered version was then posted as an official download.
The modified IntuitiveTables software reportedly checked users’ files for poker usernames and downloaded additional malicious files only if a name appeared on a hard-coded list. The apparent targets were regular high-stakes players across several sites. The use of normal update channels and official releases meant users and antivirus software did not detect the malicious code.
This adds a player-level account to the targeted software-update compromise we covered earlier this month. Jurojin’s own security notice described intermittent tampering with packages sent to a specific group of users between June 2025 and January 2026, some carrying a remote-access tool. It said the campaign ended in January, with nothing else uploaded to its servers after Jan. 28.
Jurojin called it a highly targeted operation intended to view selected opponents’ hole cards remotely, not a mass attack. The company said only a handful of high-stakes players were harmed in games where the attacker could view their cards, although more users may have received altered software. That narrower assessment differs from the players’ investigation, which suggested a far wider pool of potential targets.
Jurojin has introduced download logging, stronger administrative audit trails, tighter access to sensitive configuration and multifactor authentication for key server-data changes. It recommends a clean Windows reinstall for potentially affected users and offers its Jurojin Mesh Check tool as an alternative check. Jurojin and IntuitiveTables have also released tools intended to help users determine whether MeshAgent affected their machines.
WPN activated its ScreenShield protection Sept. 29. The feature is intended to block covered screen-capture and screen-sharing methods while allowing players to view their tables normally.
