{"schema_version":"0.10.0","id":"LR-2026-0301","record_version":1,"title":"Claude agent detects MeshAgent screen-capture malware on high-stakes poker player's machine","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":68.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":12.0,"completeness":7.04,"unhedged_language":4.52},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Risky Business · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Risky Business · subject to change"}]},"sources_hash":"d1b712ae1c4d416c844f940f0a884f3b79f403b51709f118ec1404bc5d9bf1dc"},"system":{"model_name":"Claude","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"agentic_with_tools","intended_use":"review some play statistics","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-09-25","date_disclosed":"2026-10-29","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"automated_monitor","summary":"On September 25, 2026, professional online poker player Alex was using his Claude AI agent to review play statistics when his SQL database crashed and needed to be reset. The Claude agent noticed a program called MeshAgent running in the background, apparently able to capture his screen and control his machine. The agent reported that the program had been installed on April 24, not by Alex, and identified 11 time-stamped screen-capture events, all during sessions on Americas Cardroom. Alex then found the same opponent, handle OxOO, at his table in 10 of those 11 sessions. Alex says he lost around $30,000; he was reportedly one of hundreds of players targeted over multiple years.","tags":["agentic-ai","malware","screen-capture","poker","detection"],"date_detected":"2026-09-25","near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":30000.0,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate: a stated loss of around $30,000 falls in the 10k-100k USD band.","harm_class":["financial","privacy"],"affected_description":"Alex, a professional online poker player","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/","publisher":"WIRED","date":"2026-10-29","type":"press","title":"A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards","archived_url":null,"attachment":"first_report"},{"url":"https://news.risky.biz/risky-bulletin-belarusian-state-hackers-get-on-the-data-wiping-train/","publisher":"Risky Business Newsletters","date":"2026-10-30","type":"press","title":"Belarusian state hackers get on the data-wiping train","archived_url":null,"attachment":"fingerprint","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"C","system.lifecycle_stage":"C","system.integration_type":"C","system.intended_use":"C","event.date_occurred":"C","event.date_disclosed":"C","event.trigger":"D","event.detection_method":"C","event.summary":"C","event.tags":"C","event.date_detected":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.incident_class":"C","event.agent_involved":"C","impact.direct_loss_usd":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity_because":"C","context.industry":"C","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"system.developer":[{"source_index":1,"quote":"The Chinese underground AI community has reverse-engineered the account ban system used by Anthropic for its Claude AI."}],"system.deployment_context":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"system.lifecycle_stage":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"system.integration_type":[{"source_index":0,"quote":"After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine."}],"system.intended_use":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"event.date_occurred":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"event.date_disclosed":[{"source_index":1,"quote":"— Ben Dowsett (@bendowsett.bsky.social) October 29, 2026 at 4:46 PM"}],"event.detection_method":[{"source_index":0,"quote":"After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine."}],"event.summary":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."},{"source_index":0,"quote":"After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine."},{"source_index":0,"quote":"Thanks to the Claude agent’s report, Alex could see the program had been installed on April 24, and not by Alex himself."},{"source_index":0,"quote":"Alex says the agent identified 11 time-stamped events when the program had been capturing his screen based on graphic errors it caused during screen sharing instances."},{"source_index":0,"quote":"During all 11, Alex had been playing a session on ACR, also called Americas Cardroom, a major worldwide online poker operator."},{"source_index":0,"quote":"He checked his hand histories and quickly found the most troubling info yet: The same opponent, playing under the handle OxOO, was at his table for 10 of those 11 sessions."},{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."},{"source_index":0,"quote":"Alex was one of hundreds of players allegedly targeted with this type of malware by the same reported threat actor across a period of multiple years."}],"event.tags":[{"source_index":0,"quote":"After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine."},{"source_index":0,"quote":"Alex says the agent identified 11 time-stamped events when the program had been capturing his screen based on graphic errors it caused during screen sharing instances."}],"event.date_detected":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"event.responsible_party":[{"source_index":0,"quote":"Alex was one of hundreds of players allegedly targeted with this type of malware by the same reported threat actor across a period of multiple years."}],"event.adversarial_actor":[{"source_index":0,"quote":"Alex was one of hundreds of players allegedly targeted with this type of malware by the same reported threat actor across a period of multiple years."}],"event.incident_class":[{"source_index":0,"quote":"After Alex’s SQL database crashed and needed to be reset, the Claude agent noticed something suspicious: A program called MeshAgent was operating in the background, where it seemed to be capable of capturing Alex’s screen and even controlling his entire machine."}],"event.agent_involved":[{"source_index":0,"quote":"It was September 25, 2026, and Alex, a professional online poker player, was using his Claude AI agent to review some play statistics."}],"impact.direct_loss_usd":[{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."}],"impact.severity":[{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."}],"impact.harm_class":[{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."},{"source_index":0,"quote":"Alex says the agent identified 11 time-stamped events when the program had been capturing his screen based on graphic errors it caused during screen sharing instances."}],"impact.affected_description":[{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."}],"impact.severity_because":[{"source_index":0,"quote":"Alex, who was the first to discover MeshAgent on his computer, claims he was “only” ripped off for around $30,000, a relatively moderate sum for the level he plays at; many of his peers weren’t so lucky."}],"context.industry":[{"source_index":0,"quote":"During all 11, Alex had been playing a session on ACR, also called Americas Cardroom, a major worldwide online poker operator."}]},"notes_on_gaps":"The AI agent here is the detector, not the cause: the Claude agent surfaced the MeshAgent malware and the screen-capture events, and the loss came from the external attacker's malware and alleged card-sharing. incident_class is set to security_compromise because the qualifying event is the compromise of Alex's machine; agent_involved is true only because the Claude agent was acting autonomously over his database and machine, so failure_class is left null (no agent-mechanism failure is described). The document does not state the Claude model version, developer, harness, tools, permissions, autonomy arrangement, or guardrails. Date disclosed is taken from the collector's publication metadata (2026-10-29), not from the article text. Alex's ~$30,000 loss is his own stated figure; the wider alleged theft of $1.5m-$4m across GGPoker and ACR is attributed to the scheme, not to this incident, so it is not recorded here. Country of the operator is not stated. The article also describes earlier, separate superuser incidents (Absolute Poker/Ultimate Bet, the 2013 Barcelona laptop, Mike Postle) and the broader MeshAgent campaign; these are not AI-agent incidents and are not extracted. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.date_disclosed', 'event.trigger', 'system.autonomy_level', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. The document is a security newsletter; the only AI-related concrete event is the poker malware discovery, in which a Claude AI agent was the detector rather than the cause of loss. The loss was caused by a human attacker; the AI system is not described as failing. incident_class is set to security_compromise because the qualifying event is the malware compromise, and agent_involved is true only because a Claude agent acted autonomously in noticing the malware. failure_class is left null because the agent did not fail. The $4 million figure is an investigator estimate ('might have cheated up to'), not a stated loss, so direct_loss_usd is null and severity is graded from the cited figure. No date of occurrence, player count, jurisdiction, or remediation is stated. Other AI mentions in the document (ESET on APT AI use, tokenmaxxing at Amazon, Gemini 4 Carbon, Google stock, NIK C2, Aur0ra, PHP2Shell campaign) are not concrete AI-caused incidents and were excluded. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.trigger', 'system.autonomy_level', 'system.deployment_context']. Single secondary source; corroborate before upgrading any field to B. [2026-11-01: evidence level set: Preliminary (1 report: Risky Business · subject to change)]"},"context":{"industry":"online gambling","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}