What the research found
In 2024, researchers at ETH Zurich published "Breaking reCAPTCHAv2." Using a publicly available YOLO object detection model, they solved 100% of Google's reCAPTCHA v2 image challenges, compared with 68 to 71% in earlier work. Their bot needed about as many challenges to pass as the human participants did. The authors concluded that we are now in the age beyond CAPTCHAs.
The more important finding was about how reCAPTCHA decides. It weighs cookies and browser history heavily. A browser with a convincing history passes easily. A real person with a fresh browser, a privacy setup or a VPN gets more puzzles. The puzzle was never really the test.
Who pays for CAPTCHA now
Bots don't. Solving services and vision models clear puzzles cheaply and quickly. People do: every extra grid of traffic lights is friction on a real customer, and audio and visual puzzles are hardest for people who rely on assistive technology. A control that inconveniences humans more than machines has inverted its purpose.
What replaced it, and its limits
The industry moved to invisible checks that score the browser in the background, looking at signals such as how the page was loaded, how the browser behaves and whether it matches a real device. Cloudflare's Turnstile is a well known example. These are much better than puzzles and worth using.
They answer a narrow question, though: does this session look automated? They don't answer whether a person intended the action. An AI agent acting for a real person, driving a real browser on a real device, is not an anomaly to detect. It's the new normal.
What comes next
- Attestation. The device vouches for itself cryptographically, via passkeys or privacy-preserving tokens, so the site learns that a genuine device and a person's gesture were involved.
- Cost. The submitter pays something small and refundable, so volume is expensive regardless of who or what submits.
- Agent-native paths. Instead of making agents pretend to be people, give them a legitimate way in: identify, pay, proceed.