TableLab
Home / Blog / GGPoker Banned All Third-Party Poker Software

GGPoker Banned All Third-Party Poker Software. What a Tracker Actually Does, and What Survives

By Rohit Kaul · October 26, 2026 · 10 min read

POKER NEWS The tool was the hole, so the tools are out. GGPoker bans every third-party program from December 1. Here’s what each kind does. HUD · hand tracker · table manager · results log — which was never in scope

On October 15, GGPoker announced a ban on all third-party poker software and automation tools, naming PokerTracker 4, Hold'em Manager 3, Hand2Note, Jurojin, Equilab and five others (GGPoker). Three days later it set the date: the prohibition and an in-client warning system start on December 1, 2026 (GGPoker on X). The trigger was the superuser case that broke on September 29, in which a remote-access agent planted through tampered third-party updates let someone watch about 30 high-stakes players' screens, hole cards included (PokerNews).

The word most headlines used was HUD (PokerNews; pokerfuse). That's the least interesting part. Third-party HUDs were already banned on GGPoker. What changed is that any poker program running next to the client is now out, and that puts three very different kinds of tool in one bin. This post sorts them.

TL;DR: GGPoker announced a blanket ban on third-party poker software on October 15, 2026 and set enforcement for December 1, with native multi-tabling features rolling out from October 23 to replace what the tools did. The cause was a remote-access agent delivered through tampered update packages for two desktop tools, Jurojin and IntuitiveTables, not through any poker client. About 30 high-stakes players are believed to have been targeted; who ran it is alleged, not established. GGPoker's own policy page has not been revised and still says tools that don't interact with the client won't be flagged. A HUD reads the table live, a hand tracker reads the hand histories afterward, a table manager moves the client's windows, and a results log reads only what you type. The exploit went through two table managers, and the ban reaches everything that runs beside the client. The results log was never in scope, and for live players none of this changes anything except the lesson.

What did GGPoker announce, and when?

Two things, three days apart. On October 15 a post on GGPoker's blog headed New Security Measures introduced a policy banning all third-party poker software and automation tools (GGPoker). The same post added four optional client security settings, a win-rate anomaly detector, and the end of support for Windows 7, 8 and 8.1 and macOS 11 from 2027. The post's own words on the reversal: "Previously, we permitted certain third-party tools that did not affect gameplay." It asked players to close the listed applications before launching the client, and gave no date.

Players asked whether that was a recommendation or a rule; PokerListings collected the questions from Juan Pardo, Niall Farrell, Sergi Reixach and others the next day (PokerListings). On October 18 GGPoker answered with an article on X. The prohibition and a warning system take effect December 1, 2026, with no automated warnings or penalties before then. Table swapping, layout locking and focus management arrive in the client in phases from October 23 and are finished by December 1. Repeated warnings without a prompt fix lead to restrictions up to a permanent ban, while window managers such as PowerToys and Rectangle, along with standalone RNG generators, stay permitted (GGPoker on X). PokerNews España read that as a transition period to November 30 (PokerNews España).

One detail worth knowing before December. As of October 26 the binding document, GGPoker's Security Ecology Policy, is still version 20260313, and it still contains the sentence the blog post reversed: "tools or services that do not support or interact with GGPoker during gameplay will not be flagged" (GGPoker policy). The blog and the X article say one thing, the policy page another. Until the page is revised, go by the stricter one.

From exploit to ban: the 2026 timeline Sep 29 Exploit reported Sep 30–Oct 2 Jurojin confirms Oct 6 ACR ScreenShield Oct 15 GGPoker announces ban Oct 18 Dec 1 date set Oct 23 Native multi-tabling Nov 4 ScreenShield default on Dec 1 Enforcement begins incident ACR / WPN GGPoker Sources: PokerNews, Jurojin, ACR (WebWire), GGPoker. Dates as given by each source.
Two operators, two responses: WPN shielded the screen, GGPoker removed the software. Sources in the list below.

What was the superuser case that caused it?

A remote-access agent on players' own computers, delivered through the update channel of third-party poker tools. On September 29 a cybersecurity researcher posting as WolfSec0x0 reported a covert agent on high-stakes players' Windows PCs, planted through compromised poker software, with activity going back to 2024 and about 30 users affected (PokerNews). poker.org identified the agent as Mesh Agent, part of MeshCentral, a legitimate open-source remote-management package, and described what it can do: view the screen, hole cards included, control the mouse and keyboard, run commands and copy files (poker.org).

Jurojin, a table-management tool, published a security notice confirming its part. Between June 2025 and January 2026 an attacker intermittently replaced the update package delivered to one specific group of its users with a tampered version, some of which carried a remote-access tool. It describes a highly targeted operation worked by hand, not a mass attack, says IntuitiveTables was targeted by the same actor, and says nothing has been uploaded to its servers since January 28, 2026 (Jurojin). Its later statement to PokerNews added that the spyware was installed on more machines than were actually used to snipe hands, and that its list of affected users may not be complete (PokerNews). The researcher's 2024 start and Jurojin's June 2025 window don't match, and neither source reconciles them; we report both as stated.

What is established: the agent, the delivery route, the two tools, and a count of roughly 30 high-stakes players. What is alleged: who ran it, and how much was taken. Community reports attribute the accounts to one player; Jurojin's notice calls those reports accusations and says no official investigation has confirmed them (Jurojin). One unregulated site confiscated about $100,000 from an account it banned, and individual players have estimated their own losses in the low six figures (PokerNews). No verified total exists, and we don't name the accused here.

The point that matters for the rest of this post: no poker client was breached. The researcher, Jurojin and ACR's own review all say the hole was a desktop tool sitting next to the client (ACR). That is why GGPoker's answer was to remove the tools.

Which tools are banned, and did the HUD part really change?

The named list is Jurojin, PokerTracker 4, Hand2Note, Hold'em Manager 3, StarsCaption, DriveHUD 2, IntuitiveTables, Lobbyze, Equilab and AutoHotkey, framed as not limited to those (GGPoker). It mixes four jobs: HUDs and hand trackers, table managers and layout tools, an equity calculator, and a general macro program.

The HUD part is old news. GGPoker's own feature guide from January said third-party HUDs were banned and its Smart HUD was the only permitted overlay (GGPoker), and PokerTracker's moderators have said since 2024 that PT4 offers no HUD on GGPoker, only import of downloaded hands (PokerTracker forum). What is new is that a tracker merely running in the background, or a table manager that never touched a decision, is now prohibited while the client is open, and from December 1 the client will warn when it detects them.

Jurojin's reply came two hours after the announcement: it said it understood why GGPoker was acting, and asked it to reconsider blanket restrictions regardless of what each tool does (Jurojin on X; poker.org). We found no public statement from PokerTracker, Hold'em Manager or Hand2Note as of October 26.

Our read: GGPoker is not banning tools because of what they show. It is banning them because of where they run. Any program with the client's data on your machine is a second door, and the exploit walked in through one. That's a security argument, and the distinction it ignores is the one the next section is about.

HUD, hand tracker, results log: what does each one do?

Four kinds of program get lumped together as poker software, and they read four different things. A HUD reads the table while you play and paints opponent statistics over it. A hand tracker reads hand-history files after the fact and builds a database of every hand you played. A table manager reads the client's windows and moves them: swapping, layouts, hotkeys. A results log reads nothing but what you type: the session, the buy-in, the cash-out. The first three have contact with a poker client, and they are what a ban on software running beside it reaches.

Three tools, three data sources. What each reads and what a client-side ban reaches.
ToolWhat it readsWhat it gives youTouched by the GGPoker ban?
HUDThe live table, through the client's hand feed or screenOpponent stats mid-hand: VPIP, PFR, 3-betYes. Third-party HUDs were already banned; Smart HUD is the only overlay
Hand trackerHand-history files the client writes or you downloadYour full hand database, leak finders, replaysYes, if it runs while the client is open. GGPoker's PokerCraft is the in-house replacement
Table manager / hotkeysThe client's windowsTable swapping, layouts, bet-size keysYes. Native table swapping, layout locking and focus management replace it from Oct 23
Results logOnly what you typeWin rate, hourly, variance, bankroll in buy-insNo. Not on the list, no client contact; the live-poker case was never in scope

The exploit went through the third row, not the first two. Jurojin is a table manager, IntuitiveTables a table-layout tool; both run with the client's windows in reach, both update themselves, and both update channels were tampered with. A results log never sees a card, and a phone or web app isn't on the gaming PC at all; the ban reaches what reads the client, and a log you type into reads nothing from it. That's a structural difference, not a marketing one, and it's also why GGPoker's Smart HUD and PokerCraft survive the ban: they're inside the client, so there's no second door (GGPoker).

Where each tool gets its data Poker client (live) HUD Hand-history files Hand tracker Client windows Table manager You, typing Results log In scope of the ban runs beside the client Exploit's route: row 3 tampered updates to the table managers Jurojin and IntuitiveTables No client contact
A client-side ban reaches whatever reads the client. A log you type into isn't on that path.

None of this is a knock on hand trackers. A full hand database is a better study tool than a session log, and the major operators still allow that study with the client closed. GGPoker's policy even spells out the surviving use: importing your hand histories is permitted to track your own gameplay, and nothing else (GGPoker policy, section 7.2). The ban is on what runs during the session, not on what you learn from it afterward.

Does any of this change anything at a live table?

Not the rules. There's no client in a cardroom, so there's nothing for a ban like this to reach; the live rules on phones and charts are the TDA's and the house's, and we quoted them in full in the solvers post. What transfers is the lesson about where numbers come from.

An online player who leaned on a HUD had opponent stats they never had to think about. Live players never had that, which is why reading players without a HUD is a skill rather than a setting. The same goes for your own numbers. A hand tracker's win rate is the best one there is, every hand counted, but it lives in a tool the site can now switch off. Live players only ever had the log, and even a logged win rate needs a far larger sample than most players think before it means much. The online players who have to rebuild their routine after December 1 are rebuilding toward the position live players have always been in: write it down yourself, then do the math.

Our read: GGPoker is moving toward a world where the only overlay is the one it ships and the only database is the one it hosts, and WPN says it's weighing the same. Whatever you think of that, it leaves your results in someone else's hands. Keep a copy that doesn't depend on any client existing.

What should you do if you play on GGPoker with PokerTracker or Hold'em Manager?

Three things before December 1, and one habit after it.

Where TableLab sits: it's a results log with a hand recorder, a browsable GTO library and AI hand review. It has no online-client integration, no HUD and no hand-history import; you enter sessions and hands yourself, after the fact, and the GTO numbers come from a real CFR solver we run offline, with the AI explaining those numbers rather than producing them. That is the last row of the table above by construction. The honest caveat is the same one as always: the analysis can be wrong, so verify big decisions, and at a live table your phone answers to the house rule, not ours.

What to watch next

Whether GGPoker's policy page is revised before December 1 to match the blog and the X article. Whether WPN adopts the broader third-party prohibition it said it was evaluating on October 16 (ACR). Whether PokerTracker or Hold'em Manager say anything at all. And whether any investigation produces a finding on who ran the agent. We'll update this post at the enforcement date.

FAQ

When does GGPoker's third-party software ban take effect?

GGPoker announced the ban on October 15, 2026 and said on October 18 that the prohibition and its warning system start on December 1, 2026, with no automated warnings or penalties before that date. Native table swapping, layout locking and focus management roll out in phases from October 23 (GGPoker on X).

Which tools are banned on GGPoker?

GGPoker's list names Jurojin, PokerTracker 4, Hand2Note, Hold'em Manager 3, StarsCaption, DriveHUD 2, IntuitiveTables, Lobbyze, Equilab and AutoHotkey, plus other third-party poker software and automation tools. Window managers such as PowerToys and Rectangle and standalone RNG generators stay permitted (GGPoker).

Was GGPoker's client hacked?

No report says so. The researcher who exposed the exploit and Jurojin's own notice both say the remote-access agent arrived through tampered update packages for third-party desktop tools, not through any poker client. ACR's review likewise found no compromise of its systems or downloads (PokerNews; Jurojin; ACR).

Is a bankroll tracker app allowed on GGPoker after the ban?

A results log you type into is not on GGPoker's restricted list, which names desktop programs that run beside the client: HUDs, hand trackers, table managers, an equity calculator and a macro tool. GGPoker's own PokerCraft and Smart HUD remain available. Nothing in the announcement touches a live-poker session log, which never connects to a client.

How many players were affected by the 2026 poker superuser exploit?

About 30 high-stakes players, by the estimate of the researcher who found it; Jurojin says its own list of affected users may not be complete. Loss totals reported in the press are estimates by individual players and have not been verified (PokerNews; poker.org).

The bottom line

A desktop tool's update channel was the hole, so GGPoker is closing every desktop tool, with the client warning anyone who runs one from December 1. The HUD headline was already true; the new part reaches trackers and table managers that never influenced a decision. Sort your tools by what they read. The ones that read the client are gone on GGPoker and may follow elsewhere. The one that reads only what you type was never in scope, and it's the one your long-run numbers should live in anyway.

Log the session, the buy-in and the cash-out yourself, and keep that record somewhere no client can revoke. Start logging your sessions.

Sources

Facts are as published by the named sources on the fetch date, 2026-10-26. The identity of the person behind the remote-access agent and all loss figures are allegations or estimates reported as such; no official finding had been published in the sources as fetched. GGPoker's enforcement details are its own stated plan and may change before December 1. Poker carries real variance and real risk; nothing here is financial or legal advice. Corrections: [email protected].