A new AI CAPTCHA solver does more than crack the puzzles meant to keep bots out. It gets better every time it sees one, and it learns most new puzzle types after just one or two encounters, with no human labelling the data.
The research, which Bruce Schneier flagged on his blog on 19 October 2026, goes after a quiet assumption behind modern CAPTCHAs: that a bot which fails today will keep failing.
Key takeaways
- The paper, “CAPTCHAs in the Agentic Era” by Oguzhan Salman and Kemal Bicakci, was posted to arXiv on 2 September 2026.
- It pairs a fast YOLOv8 object detector with a slower, open-weight vision-language model and turns every answer the big model gives into training data for the fast one.
- It reached 85.4% overall accuracy across 16 CAPTCHA classes, beating either part on its own.
- In a simulated year of monthly defensive updates, the solver recovered after every single one.
- A teacher model that was right only about 70% of the time hardened the detector about as well as a perfect one.
How does this AI CAPTCHA solver actually work?
The system has two parts. A vision-language model (VLM), an AI that reads images and text together, can reason its way through an unfamiliar puzzle. It is also slow and expensive, and the paper notes it treats “the hundredth instance of a familiar puzzle” exactly like the first.
A specialised detector does the opposite. YOLOv8 is a popular object-detection model that answers in milliseconds, but only for the categories it was trained on. Show it a new puzzle and it is stuck.
The authors put a confidence-based router between the two. When the detector is sure of its answer, it handles the puzzle. When it isn’t, the VLM takes over. Then every VLM answer is saved as a label and fed back into the detector’s training.
Think of a junior chef working beside a head chef. The first time a strange order comes in, the head chef cooks it while the junior watches. After a couple of tries the junior can cook it alone, so the head chef only steps in when something new arrives.
One detail matters for defenders. The solver works only from screenshots and operating-system mouse and keyboard events. It does not use browser automation or read the page’s code (the DOM), which means many of the usual tricks for spotting scripted browsers have nothing to catch.
How does it compare with other approaches?
| Approach | Speed | Handles new puzzle types? | Improves with use? |
|---|---|---|---|
| VLM agent alone | Slow, costly per puzzle | Yes, from scratch each time | No |
| Specialised detector alone | Milliseconds | No, only trained categories | No |
| Hybrid in the new paper | Fast on familiar puzzles | Yes, via the VLM | Yes, usually after 1-2 encounters |
The paper reports 85.4% overall accuracy and 84.2% macro accuracy, an average that weights all 16 classes equally so rare puzzle types count as much as common ones.
Why the arms-race result is the real story
CAPTCHA providers fight back by changing their images. hCaptcha said in a 23 February 2026 blog post that if a challenge “starts to see higher automation solve rates, it is rapidly discarded or updated to break bots again.”
The researchers tested that strategy directly. They added adversarial perturbations, small pixel changes designed to confuse a model, and pushed the public detector’s accuracy to 0%. The VLM was not affected. Its answers became fresh labels, and the detector retrained and recovered.
They then simulated a year-long arms race with new perturbations every month. The solver bounced back each round. The most uncomfortable finding for defenders is that a cheap teacher that was right only about 70% of the time hardened the detector about as well as a perfect one. An attacker doesn’t need a top model, just one that is good enough.
Is this new, or have CAPTCHAs been losing for a while?
Image CAPTCHAs have been in trouble for years. In September 2024, ETH Zurich researchers Andreas Plesner, Tobias Vontobel and Roger Wattenhofer reported solving 100% of Google’s reCAPTCHAv2 image challenges with YOLO models, up from 68-71% in earlier work. They also found evidence that reCAPTCHAv2 leans heavily on cookies and browsing history to decide who is human.
Newer work goes after the harder interactive puzzles. CaptchaAgent, posted to arXiv on 9 October 2026, reported Pass@1 gains of 21.3 to 25.8 percentage points over a commercial browser-agent baseline on the Open CaptchaWorld benchmark.
What the Salman and Bicakci paper adds is time. Earlier studies showed bots could pass a CAPTCHA once. This one suggests that changing the puzzle buys defenders less and less each time.
What this means if you run a website
My opinion: treat a visual puzzle as a speed bump, not a wall. It still adds cost for attackers. hCaptcha, for example, says its enterprise customers saw attack volume fall by 70-90% after deployment. But it should be one layer among several.
- Rate limits: cap sign-ups, logins and checkouts per account, device and IP range.
- Behavioural signals: session history and account age are harder to fake than a solved grid of traffic lights.
- Friction where it counts: save email or phone verification for high-value actions.
- Monitoring: watch for solve rates that recover suspiciously fast after you rotate challenges.
What happens next
Expect CAPTCHA vendors to rely less on what the user can see and more on who the user seems to be, through device, history and behaviour checks. hCaptcha is already pitching agent detection and arguing that legitimate AI agents should identify themselves rather than pretend to be human.
On the research side, the open question is cost. The paper’s design makes repeat puzzles cheap, which removes one of the last economic arguments for visual challenges. Watch for follow-up work testing these self-improving solvers against live, risk-scored CAPTCHAs rather than simulated arms races.
FAQ
Can AI solve CAPTCHAs now?
Yes, many visual ones. Research has shown 100% success on reCAPTCHAv2 image challenges (2024), and the new hybrid solver reached 85.4% accuracy across 16 CAPTCHA classes.
Why doesn’t changing the CAPTCHA images stop it?
The vision-language model keeps solving the altered images. Its answers retrain the fast detector, which recovered after every monthly change in a simulated year.
Should websites stop using CAPTCHAs?
Not necessarily. They still add cost and friction for attackers, but they work best alongside rate limits, behavioural signals and verification for high-risk actions.
Next step: check which of your site’s forms rely only on a CAPTCHA, and add one more layer to each this month.
Leave a comment