A working log from our GGPoker bot crew.

What we mean by "poker bot" in 2026

Here, a poker bot is software that takes visible game state as input (your own hole cards, the community cards, the betting history, stack sizes, position) and produces an action under a real-time latency constraint. It receives no raw packets and knows neither an opponent's hidden cards nor the unshuffled deck. Everything a bot does, a human could do with the same information; the bot's only edge is speed and scale.

The software has three layers. The first is a solver-anchored baseline: precomputed strategies from counterfactual regret minimisation (CFR) variants, usually PioSolver or GTO+ for heads-up trees and MonkerSolver for multiway spots. These outputs are too large to run online and too slow to query naively, so the production system compresses them into action-frequency tables keyed on bucketed game states. The second layer is the opponent model, where most current research focuses on lightweight online updates that converge in tens to low hundreds of hands against an anonymous opponent. The third is a policy combiner that decides how far to deviate from the baseline given the current opponent estimate, and folds in detection-aware behavioural noise.

The GGPoker ecology in one page

GGPoker has been run by NSUS Group since launch, and by traffic it is the largest cash-game and tournament site in 2026. Researchers focus on the design and architecture decisions governing what a bot can and cannot do on the platform. The WSOP affiliation and ambassador roster are marketing, not research concerns.

Anonymous tables with rotating screen names prevent long-horizon HUD tracking because there is no stable identifier to accumulate 50,000 hands against. The Smart HUD is operator-controlled and deliberately limited, and third-party HUDs and overlays are banned outright. And PokerCraft, the customer-facing analytics product, exposes only a thin slice of a much larger internal model that the security team runs against the entire player base to find statistical outliers. Detection relies on that internal model, not the dashboards players see. What the operator has put on the record about bots, with dates, is collected in does GGPoker have bots. For a review of GGPoker read purely on its security, integrity rules and enforcement record, see our GGPoker security review. Why the public traffic numbers cannot be used to count bots is in GGPoker traffic. What GGPoker's own Spin & Gold rules page says, and what that format does to an automated account's footprint, is in Spin and Go bots on GGPoker. What the mobile client is, why the Android app installs off the Play Store, and what the policy scans on a phone, is in GGPoker mobile and bots. How GGPoker's rake and the renamed Ocean Rewards program work, and why a volume-based rewards economy both draws and reads bot farms, is in GGPoker rake and bots.

How detection actually works

Detection runs asynchronously across weighted layers, so no single event flags an account. Signals accumulate over time. An escalation fires only once the combined score crosses a threshold set conservatively against a false-positive budget.

Behavioural fingerprinting

Per-session client telemetry: the distribution of input timing, how long a finger rests on a button before selecting it (touch dwell on mobile), how curved the cursor path is on desktop, and the latency between choosing an action and confirming it. This telemetry is cheap to compute and runs continuously. Naive implementations are most vulnerable to it.

Statistical play-pattern analysis

Distributional outliers: VPIP/PFR ratios sitting on solver mass with too little variance, bet-sizing clustered on exact pot fractions, fold-to-3bet frequencies that track the population to within ±0.5pp across thousands of hands. Pure GTO output is easier to flag here than a noisier strong-human strategy, because population variance is the baseline.

Anti-collusion graph models

Account graphs joined by IP, device fingerprint, deposit method, KYC document, and table co-occurrence. This layer catches most of the high-impact bans (chip dumping, soft-play); botting is a side-product when an operator runs a bot farm under one fingerprint.

Human review on flagged accounts

Humans decide on accounts flagged by mathematical models. A reviewer reads hand history, looks at chat behaviour, checks whether the account ever sits out for a phone call. Most botting bans are signed off here, not in an automated rule.

Areas covered on this site

Open questions for developers

The notes on this site are not finished. I'd welcome discussion on five open threads:

1. Online opponent-model convergence. Under anonymous-table rotation, what is the minimum hand count for a useful exploitative deviation? The current empirical minimum is around 80-150 hands for a generic VPIP/PFR/3-bet estimate; can a Bayesian prior on the population distribution cut this to 40-50 while holding up across fish-vs-reg priors?
2. Multi-table state isolation. Running four GGPoker tables on a single device with a shared opponent cache without leaking timing correlations across hands. The naive implementation gets caught on cross-table action-latency synchronisation.
3. Detection-aware policy combiners. Treating the operator's classifier as a noisy adversary and shaping the output distribution to maximise EV under a budgeted detection probability. The literature on adversarial classification (Dalvi et al. 2004 onward) is mostly about spam; the poker case has an asymmetric cost matrix.
4. LLM-augmented decision support. Frontier LLMs hallucinate poker ranges and misapply ICM. They have no calibrated frequency intuition. They may help with hand-history annotation and exploit hypothesis generation, but not with live decisions.
5. MTT automation. ICM, bubble factor, and stack-depth variance make tournaments meaningfully harder to automate than cash. Feasibility is not in question; where the EV-per-engineering-hour curve flattens remains unclear.

Contributions are welcome from anyone with first-hand knowledge of implementations or datasets touching the above. I try to answer every serious message, and those exchanges help me update these notes far faster than I could alone.

Bottom line

Most "GGPoker hack" claims are sales copy. For questions about what is feasible on GGPoker today and what is not, talk to our team.