CAPTCHA

A poorly designed AI agent may fall into a closed loop of goal → call API → failure → retry → loop, continuously consuming resources and accumulating costs without human monitoring.

The naming of CAPTCHA pays homage to the Turing Test proposed by Alan Turing in 1950, but in the opposite direction: the Turing Test has humans judge whether a machine possesses human intelligence, whereas CAPTCHA has a machine judge whether a user is human.

CAPTCHA was systematically formalized by Luis von Ahn and others at Carnegie Mellon University around the year 2000.

When a platform allows Agents as legitimate users, CAPTCHA's goal of verifying whether the operator is human directly conflicts with the business goal, and is logically incoherent.

Traditional anti-abuse measures (such as CAPTCHA, email verification, phone-number binding and behavioral analysis) are almost useless against Agents, because an Agent can instantly complete registration, read the documentation and submit content at extremely low cost.

The image-understanding capabilities of modern multimodal large models have greatly eroded CAPTCHA's assumption that it is "easy for humans, hard for machines," and many CAPTCHAs can be solved with high accuracy.

Defense-in-depth measures on the service side include rate limiting, behavioral fingerprinting, CAPTCHA challenges, and login failure lockout, which can raise the cost of abuse without harming normal anonymous users.

The core idea of CAPTCHA is to design tasks that are easy for humans but difficult for programs, such as recognizing distorted text, clicking on images, and dragging sliders; modern schemes also combine browser fingerprints, mouse trajectories, IP reputation, and other signals for frictionless scoring.

The APX browser tool provides a browser_handoff action for login, password, 2FA or CAPTCHA scenarios, recording a brief reason, marking the browser card as in handoff state, and waiting up to five minutes for the owner to complete the action.

Common CAPTCHA forms in dark web market scenarios include distorted character recognition, slider puzzles, clicking specific target images, and Cloudflare-style Turnstile.

Dark web markets generally deploy a wide variety of CAPTCHA challenges to block automated crawlers.

CAPTCHA was proposed by a team at Carnegie Mellon University around 2000.

CAPTCHA stands for Completely Automated Public Test to tell Computers and Humans Apart.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a common means of preventing automated programs from abusing forms and interfaces; typical implementations include Google reCAPTCHA and Cloudflare Turnstile, and its core principle is to distinguish real human users from scripted programs through image recognition, behavioral feature analysis, or interactive challenges.

Proxies primarily change the network exit point and do not automatically resolve issues such as CAPTCHAs, rate limiting, or fingerprinting detection.

Many websites deploy CAPTCHA, behavioral fingerprint detection, IP rate limiting, and other means to identify automated traffic, and large-model-based Agents may still be intercepted due to headless browser characteristics or abnormal click patterns.

Research from Anthropic reveals that AI agents acting autonomously on the internet display emotions similar to human 'frustration' when confronted with CAPTCHA verification.

As AI visual recognition and reasoning capabilities advance, the protective effectiveness of traditional CAPTCHAs is being continuously eroded.

CAPTCHAs are one of the most typical technical obstacles currently faced by Computer Use-type agents; mainstream e-commerce platforms present slider or image-based CAPTCHAs when anomalous behavior is detected.

AI breaking through CAPTCHAs poses a fundamental challenge to internet identity verification, as traditional solutions such as phone number verification and email confirmation essentially only transfer trust to carriers and email service providers.