In a fitting sign of the times, the hacker’s carefully laid plans were foiled by an AI agent.

It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics. (Alex only agreed to speak with WIRED under a pseudonym to avoid any risk of reprisals from threat actors.) After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine.

Thanks to the Claude agent’s report, Alex could see the program had been installed on April 24, and not by Alex himself. Alex says the agent identified 11 time-stamped events when the program had been capturing his screen based on graphic errors it caused during screen sharing instances. During all 11, Alex had been playing a session on ACR, also called Americas Cardroom, a major worldwide online poker operator.

He checked his hand histories and quickly found the most troubling info yet: The same opponent, playing under the handle OxOO, was at his table for 10 of those 11 sessions.

The handle was familiar. Alex and several friends in the high-stakes community had shared suspicions about this player’s behavior in the past. Alex checked the player’s win rate stats via a public tracking site; they were astronomically higher than the best players in the world, a statistical impossibility given the sample of hands played. In Alex’s view, it was glaringly obvious that this player was cheating.

An investigation by Alex and other members of the high-stakes community in subsequent days confirmed his fears—and then some. Alex was one of hundreds of players allegedly targeted with this type of malware by the same reported threat actor across a period of multiple years. Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky.

With millions of dollars allegedly stolen across the biggest sites on the internet, the poker world is searching for answers about how the scheme was allowed to continue so long, whether major sites took the risk seriously after it was reported, and whether online poker itself has been irreversibly compromised.

Poker has never been short on cheating controversies; online poker especially so. The “superuser” method, in which a cheater gains unauthorized access to their opponents’ cards and can therefore act with perfect information against them, was one of the first to show up online.