Luhui Dev

Posted on Aug 16 • Originally published at luhuidev.com

Can AI Beat CAPTCHAs in 2026? From Recognition to Risk Scoring

#ai #agents

🙋‍
I’m Luhui Dev, a developer who has been breaking down Agent engineering and exploring how AI can be applied in education.
I focus on Agent Harness, LLM application engineering, AI for Math, and the productization of education SaaS.

Most of us know the routine: you sign in to a website, click “I'm not a robot,” and get a 3×3 grid asking you to select every traffic light, motorcycle, or bus. You finish one round and another appears. Sometimes you are sure the answer was right, yet the system asks you to try again. On an unusual network, the challenges may keep coming.

CAPTCHAs were designed to make life difficult for machines. Today, machines may already be better than humans at many of the puzzles.

In 2024, researchers tested Google reCAPTCHA v2 without using GPT. They trained a YOLOv8 vision model to identify target objects and paired it with browser automation. Their paper reported passing all 100 test attempts.

By 2025, research had moved beyond individual CAPTCHA formats. Unified benchmarks began testing vision-language models against distorted text, image selection, sliders, rotation tasks, and other CAPTCHA types. Some now resemble ordinary visual recognition. Others still require exact localization, spatial reasoning, and sustained interaction, where success rates fall sharply.

In 2026, the question has moved again. It is no longer only “Can AI understand the CAPTCHA?” It is now: “Can AI open the page, understand the challenge, click or drag, notice mistakes, correct itself, and then continue the original task?”

The answer is increasingly yes.

That is why CAPTCHA is worth revisiting. It has not disappeared as a security control, but its original assumptions are changing. In 2026, we need a more precise picture of what AI CAPTCHA solving can actually do.

CAPTCHA's Original Bet: Humans Can Do It, Machines Cannot

The core idea behind CAPTCHA is simple: find a task that is easy for people and hard for machines, then use it to tell the two apart.

The classic early version was distorted text. Letters were rotated or merged, with noise and lines in the background. A person could usually squint and read them; early OCR systems could not. As OCR improved, CAPTCHA providers changed the test. Google reCAPTCHA increasingly used images, asking people to identify cars, traffic lights, or motorcycles.

The game stayed the same: find a perceptual skill that humans possess and machines do not—at least for now.

The problem is that those exact capabilities have been among AI's fastest-improving areas over the last two decades: OCR, image classification, object detection, speech recognition, and now vision-language models. CAPTCHA keeps looking for new machine blind spots, and machines keep catching up.

That is why a single question such as “What is AI's CAPTCHA accuracy?” is no longer enough. A useful analysis needs at least three layers:

Recognition: can the AI understand the challenge and determine the right answer?
Interaction: once it knows the answer, can it click, drag, and handle multiple rounds in the browser?
Acceptance: even if it solves the puzzle, will the server-side risk system accept the request?

These are increasingly different problems.

Text CAPTCHAs Have Largely Become an OCR Problem

Traditional text CAPTCHAs can no longer carry a critical security boundary on their own. The reason is straightforward: they are fundamentally an OCR task.

If a site still uses fixed fonts, a fixed noise distribution, and a fixed string length, an attacker who can collect enough samples does not need frontier research to train a specialized model. In many cases, a large model is unnecessary.

People often imagine general systems such as GPT, Gemini, or Qwen when discussing AI CAPTCHA solvers. For a fixed challenge, however, a specialized model can be cheaper and faster. A trained OCR or lightweight vision model can run locally at extremely low marginal cost.

Image-Grid CAPTCHAs Increasingly Look Like Ordinary Object Detection

Image CAPTCHAs once raised the barrier considerably. “Select every image containing a bus” was difficult for early computer vision. Today, the task definition is familiar: object detection and image classification.

The 2024 paper Breaking reCAPTCHAv2 used YOLOv8 to identify target categories in reCAPTCHA v2 image challenges, then automated the clicks. It reported passing all 100 test attempts.

That “100%” does not mean reCAPTCHA as a whole is useless. It means that, under the experiment's specific conditions, the image puzzle itself did not reliably distinguish machines from people. reCAPTCHA still uses cookies, browser context, history, risk scoring, and other mechanisms that do not vanish when image recognition succeeds.

But the most visible assumption—that a machine should not recognize a traffic light—is failing.

Attackers No Longer Always Need a Custom-Trained Model

Using YOLO against reCAPTCHA follows a traditional recipe: collect data, label it, and train a solver for one CAPTCHA format. This approach is cheap, fast, and stable, but it is closely tied to the challenge type.

If the test changes from “find the cars” to “select two objects used for the same purpose,” a model trained only on cars, buses, and traffic lights may fail.

Vision-language models change that constraint. Models in the Qwen, Gemini, and GPT families can jointly understand images, written instructions, and spatial relationships rather than recognizing only a fixed set of categories.

The 2025 study MCA-Bench placed multiple CAPTCHA formats into a unified vision-language evaluation framework. It found that trained Qwen2.5-VL models could reach high success on some distorted-text and 3×3 image-selection tasks, while performance dropped substantially on sliders, rotations, and complex spatial reasoning.

That difference shows where CAPTCHA difficulty is moving. The old challenge was understanding the image. The new challenge is translating that understanding into precise interaction.

Why Slider CAPTCHAs Were Harder

A slider CAPTCHA is a useful example. An image contains a missing puzzle piece, and the user must drag a slider until the piece lines up with the gap.

That adds a layer beyond an image grid. The grid asks, “Where is the traffic light?” The slider also asks, “Where is the gap, how far should I drag, and does the trajectory look plausible?” It combines perception with behavioral interaction.

This did not create a permanent security boundary. The 2024 paper The robustness of behavior-verification-based slider CAPTCHAs evaluated five widely deployed slider systems and reported attack success rates from 87.5% to 100%.

Once again, a determined attacker can customize an algorithm for a particular challenge. Replacing an image grid with a slider is not a permanent fix. Gap detection is already a mature computer-vision task. The harder signals increasingly sit around the puzzle: pointer trajectories, timing, page context, session history, and IP reputation.

In 2026, GUI Agents Are Starting to Solve CAPTCHAs Themselves

What makes the current wave different is that GUI agents are beginning to treat CAPTCHAs as ordinary web interactions.

The 2026 paper CAPTCHA Solving for Native GUI Agents introduced ReCAP, a native GUI agent specifically trained to improve CAPTCHA capability. Instead of sending screenshots to one model and having a separate script parse answers and click, the model directly observes screenshots and emits GUI actions. It can find targets, click, inspect the next frame, detect an error, and correct its behavior.

The researchers trained models in the Qwen3-VL family. The 32B model achieved roughly 81% overall success on the paper's dynamic CAPTCHA benchmark, averaging about 1.54 model calls and under three seconds of end-to-end execution. These are results from a specific benchmark, not a universal pass rate for real websites.

The direction is nevertheless clear: CAPTCHA solving is moving from a specialized offensive skill toward a side capability of general Computer Use agents.

In the past, bypassing a CAPTCHA required someone to build a dedicated solver. A future agent may be booking a ticket, shopping, or filling in a form, encounter a CAPTCHA halfway through, solve it, and continue the original task.

Solving the Puzzle Is Not the Same as Passing the System

The research results above can make “CAPTCHA is dead” sound tempting, but reality is more complicated.

Suppose an AI identifies every traffic light with perfect accuracy and clicks all nine images correctly. Google may still reject it. Modern CAPTCHA systems do much more than grade the visible answer.

The server sees far more than a screenshot. It can inspect the IP and whether it belongs to a data-center ASN, whether the device has appeared before, cookie history, browser consistency, request frequency, repeated challenges within a session, account age, and deviations from ordinary behavior.

That is why Recognition, Interaction, and Acceptance must be separated. A model with 98% accuracy on an offline benchmark does not automatically have a 98% end-to-end pass rate. Recognition is only one layer.

The Economics of Attacking CAPTCHAs Have Changed

CAPTCHA's main attack cost once came from the machine's inability to solve the puzzle. That cost is falling quickly.

Specialized OCR and YOLO models can run entirely on local hardware. Open-weight vision-language models are also becoming broadly available. For fixed tasks, pure inference can have a very low marginal cost.

The public CAPTCHA-solving market tells the same story. As of August 2026, one public provider lists ordinary image CAPTCHAs and reCAPTCHA v2 at approximately $0.50 to $2.99 per 1,000 solves. These prices change and may combine human and automated capacity, but they demonstrate how commoditized “getting the answer” has become.

At scale, the expensive parts are increasingly not CAPTCHA recognition itself, but proxy IPs, clean reputation, realistic browser environments, device identity, account inventory, session maintenance, and retries.

The defensive goal has changed accordingly.

The old goal was to make the puzzle impossible for machines.

The more realistic goal now is to make automation uneconomical at scale.

Google No Longer Puts the Puzzle at the Center

Google's own direction shows how far reCAPTCHA has moved.

reCAPTCHA is now part of a broader Fraud Defense system. Instead of asking only whether a puzzle answer is correct, it evaluates the risk of the request. The server can receive a score from 0.0 to 1.0: 1.0 means traffic is very likely legitimate, while 0.0 means very likely illegitimate. The application then chooses the response. Google's assessment API also includes a verifiedBots field for bots whose identities have been verified.

In a login flow, a low-risk request might proceed directly, medium risk could trigger email verification, higher risk could require MFA, and the highest risk could be denied.

The old model was: solve the CAPTCHA and pass. The new model is: collect signals, calculate risk, and let the application decide whether to allow, step up, or reject.

Cloudflare Goes Further: Ideally, Users Should Not Solve Anything

Cloudflare Turnstile is even more representative. It looks like a CAPTCHA alternative, but its design goal shifted from making users complete a challenge to letting legitimate users pass with as little friction as possible.

The Turnstile documentation explains that the browser runs a series of small non-interactive challenges and gathers signals about the client and environment. These include proof-of-work, proof-of-space, Web API probing, browser quirks, and behavioral signals. Managed mode selects an action based on client-side signals and risk; low-risk visitors can pass without interaction, while a checkbox appears only when another check is needed.

Even if a challenge appears solved in the browser, Cloudflare requires the token to be validated on the server. Its documentation explicitly states that a solved challenge does not automatically confirm that the visitor is human.

That sentence captures the state of CAPTCHA in 2026.

Being able to solve the puzzle no longer means passing the security decision.

hCaptcha Has Not Abandoned Active Challenges

hCaptcha takes a somewhat different path from Google and Cloudflare. It retains more active visual challenges while also offering invisible operation and risk scores. Invisible mode can run in the background and show a challenge only when the user meets its criteria; fully passive operation relies on the enterprise risk score.

The logic is intuitive: even if current models break one CAPTCHA format, providers can change the task, add interaction complexity, and rotate challenges to reopen a temporary gap between people and machines.

Researchers have pursued the same idea with visual illusions, audio illusions, and more complex spatial reasoning.

The 2026 paper Robust CAPTCHA Using Audio Illusions in the Era of Large Language Models introduced IllusionAudio. It reported a 0% bypass rate across the tested large-audio-language-model and ASR attacks, alongside a 100% human pass rate in its user study.

That is an impressive experimental result, but it faces a familiar question: once the format is public, attackers can collect targeted data, generate samples, and fine-tune models.

The twenty-year history of CAPTCHA repeats the same cycle: find a new human-easy, machine-hard task; deploy it; train machines; break it; add complexity; and find another task.

Generative AI has not ended the cycle. It has made it spin faster.

The Hardest Problem May Be Legitimate AI Agents, Not Malicious Bots

CAPTCHA's original model missed another possibility: future machine traffic will not always be bad traffic.

Historically, bots meant crawlers, spam sign-ups, credential stuffing, ticket scalping, inventory abuse, or automated ad clicks. It was tempting to equate Human with Good and Bot with Bad.

The agent era breaks that assumption.

An AI agent booking my hotel is a bot—but should it be blocked? Not necessarily. An agent can submit an expense report, help a blind user navigate a site, compare products and place an authorized order, or operate enterprise SaaS on an employee's behalf. These are automated programs, but they may carry genuine user authorization.

Google's risk-analysis API now includes the concept of a verified bot identity, which points toward this future. Websites may need to stop asking only “Are you a robot?” and instead ask: Who is this agent? Who authorized it? What is it trying to do? What scope is permitted? What is its reputation? Is it making three requests a minute or thirty thousand?

Frequently Asked Questions

Can AI solve CAPTCHAs in 2026?

AI can solve many of them, but recognizing the correct answer and being accepted by the server are different outcomes. Text and common image CAPTCHAs are highly solvable. Sliders, rotation, and multi-step dynamic challenges remain harder, while modern risk systems also evaluate IP, device, browser, account, and behavioral signals.

Is the reCAPTCHA v2 image challenge still secure?

The image puzzle alone should no longer be treated as a stable human-machine boundary. A 2024 study passed 100 test attempts under specific conditions, but reCAPTCHA's overall security also relies on risk scoring, cookies, browser history, and other signals.

Why do GUI agents change the CAPTCHA threat model?

They connect recognition, localization, clicking, dragging, feedback, and error correction into one end-to-end process. CAPTCHA solving can therefore become one step that a general web agent performs during a larger task, rather than a capability limited to dedicated solvers.

How should websites respond to AI CAPTCHA solvers?

Do not use a visual puzzle as the only security boundary. Combine risk scoring, rate limits, device and session signals, account reputation, MFA, and server-side token validation. Over time, authorized agents will also need verifiable identity and scoped permissions.

Conclusion

The last three years show a clear progression.

Text CAPTCHAs fell first. Image CAPTCHAs increasingly became ordinary object detection. Vision-language models began solving formats that once needed separate specialized models. GUI agents then connected recognition to action.

The remaining difficulty is concentrating in dynamic, multi-step tasks, precise control, and risk decisions made in real server environments.

That is why the most advanced CAPTCHA products in 2026 look less and less like CAPTCHAs. Google calculates risk scores. Cloudflare watches the browser and client environment. hCaptcha combines active challenges with passive signals.

The goal is no longer to invent a puzzle that AI can never solve; that promise is becoming impossible to sustain. The practical goal is to make legitimate access almost frictionless while increasing the cost of large-scale automated abuse until it is no longer worthwhile.

DEV Community