Reference · Article

Online Poker Bot

Automated software that plays internet poker without continuous human input. The category encompasses rule-based agents, equilibrium solvers, and hybrid systems, and is defined as much by the operators who deploy it as by the algorithms themselves.

Automated online poker play — the use of software that participates in cash games or tournaments on internet poker platforms without continuous human supervision — sits at the intersection of three older fields: imperfect-information game theory, online fraud detection, and the economics of low-margin gaming operators. The software in question is not a single artefact. It ranges from small Python scripts that fold every hand outside a starting range, to industrial systems that pair a counterfactual-regret solver with a screen-scraper, a randomised motor controller for cursor paths, and an account-management layer responsible for laundering profits across many seats.

Operators of internet poker sites have responded to automated play in three overlapping ways: by tolerating it where it sustains liquidity, by detecting and refunding it where it threatens recreational revenue, and by legally pursuing the small subset of operators who run large coordinated rings. Public reporting tends to flatten this picture into a binary — “bots are everywhere” or “the sites have it solved” — but the underlying reality is governed by platform incentives rather than by technical possibility alone.

Definition and scope

A working definition, drawn from the academic literature on computer poker, is any software process that selects actions at one or more poker tables and submits them to a remote game server, with the intent that those actions be processed as if originating from a human. Definitions in operator terms-of-service typically extend this to any automation that gives a measurable informational advantage, including hand-history scraping, real-time solver consultation, and seat-selection scripts.

The category therefore includes systems that never autonomously click a button. A real-time advisory tool that whispers a solver's recommendation into a human player's ear is, under the terms-of-service of every major regulated platform, treated identically to a fully autonomous agent.

Architecture of a modern agent

A representative system, circa 2024, comprises five layers:

1. Table observation. The visible state of the table — cards, stacks, bet sizes, position — is reconstructed either from the game client’s memory, from screen pixels via OCR, or from a network-protocol parse.
2. Hand abstraction. The observed state is compressed into a small number of buckets (e.g. board texture × range vs range), a step required because game-theoretic solvers cannot operate directly on the 10¹⁶¹-node tree of full no-limit hold’em.
3. Strategy lookup. A pre-computed strategy table, often gigabytes in size, returns a mixed action distribution for the current bucket. Modern systems augment this with a neural network trained to interpolate between buckets.
4. Action sampling and motor control. A bet size and timing are sampled, then dispatched through a humaniser layer that adds noise to click coordinates, mouse paths, and decision latencies.
5. Account orchestration. Bankroll is allocated across seats, sessions are scheduled around peak fish hours, and withdrawals are routed through funding sources designed to survive operator review.

Platforms where activity is observed

Activity is unevenly distributed. The largest concentration in 2025 sits on Asia-facing club applications — private, semi-permissioned mobile clients organised around “clubs” with a host who controls membership. Regulated Western operators, working under licence conditions that require demonstrated game integrity, invest meaningfully more per active account in detection. The result is a steady migration of automated activity toward platforms where enforcement is structurally weaker.

The detection arms race

Detection has passed through three broad eras, summarised in the subpage on detection history. Early heuristic methods — per-session timing variance, click-coordinate clustering — were defeated within months of disclosure. Behavioural analytics drawn from telemetry beyond the poker decision itself (window-focus events, peripheral entropy, OS fingerprinting) extended the half-life of detection through the late 2010s. Since approximately 2024, the most consequential signal has been graph-based: not what a single account does, but the joint history of accounts that share funding, IP ranges, or temporal patterns.

Legal and operator response

Operator response divides into four standard remedies, applied in escalating sequence after a graph-detection confidence threshold is crossed: account closure with bankroll seizure, refund of impacted opponents from seized funds, exclusion of associated payment instruments from the operator’s network, and — rarely — civil action against named operators of large rings. Regulators in Malta, the Isle of Man, and several U.S. state jurisdictions have begun requiring disclosure of the first two figures in licensee reports, which has had the secondary effect of making detection rates partially observable to the public.

Further reading

References