What happened
Winning Poker Network, which runs ACR, answered the Mesh Agent scandal with a seven-minute video from CEO Phil Nagy and a new feature called Screen Shield, which stops WPN tables from appearing in screen-capture and screen-sharing tools. Nagy said no poker clients are believed to have been compromised: the attacks ran through malicious third-party software on players' own computers. WPN contacted affected players on Tuesday, September 29, whose machines were running remote-access software, and switched Screen Shield on for them. Players will be able to turn it on themselves in a later update, which also means they can't stream or screenshot the table.
WPN said it sent affected players' hand histories to GTO Wizard for review and that a wider investigation, which could end in compensation, is underway. Jurojin, one of the two compromised tools alongside IntuitiveTables, has now said an attacker intermittently swapped its update package for a tampered one, for one group of users, starting in June 2025. The researcher who first reported the case had put the activity back to March 2024.
Players say the accounts were reported long before any of this. CoinPoker ambassador Patrick Leonard said regulars had reported them for over a year. He said CoinPoker's security team banned the Europe account, registered to Paul Gregg, and confiscated more than $100,000, and that no site has ever told another which players it banned. Mobius Poker's Patrick Howard said the player was reported “probably dozens of times.” No platform has confirmed Gregg, named in a player's complaint, as the operator.
Why it matters
Screen Shield treats this as a screen-sharing problem, which for the roughly 30 affected players it was. The second problem is the one Leonard described: one site bans an account, says nothing, and the same person keeps playing elsewhere. Nothing announced so far changes that.
