- Researchers describe a CAPTCHA solver that reached 85.4% overall accuracy across 16 classes and learns new puzzle types, typically after one or two encounters.
- In a simulated year-long arms race, it recovered after every monthly attempt to defeat it. The authors say defenses that assume a failing bot stays failing understate how fast it returns.
- Teams that rely on visual CAPTCHAs should ask what else backs them up if a solver adapts.
A defense that measures one moment
A visual CAPTCHA, the puzzle that asks you to pick out traffic lights or crosswalks, is a bet. It bets that a bot fails today and will keep failing tomorrow. A new arXiv paper challenges the second half of that bet.
The thesis here is simple. The test checks a bot on one day, but the bot can learn on every day. Defenses built on a snapshot of weakness lose value as the solver improves.
This account draws on the paper's abstract, posted on arXiv on 2 September 2026 and shared by Schneier on Security on October 19. The details below are the authors' claims, not independent tests.
What the researchers built
The authors start with two kinds of solver and the flaw in each. Vision-language models, which read images and text together, can solve visual CAPTCHAs without special training. But an agent built on one treats every puzzle as new. The hundredth familiar puzzle costs as much time and computing as the first.
Specialized detectors work the other way. They answer in milliseconds, but only for puzzle types they were trained on. The authors say neither kind improves with exposure.
Their system pairs a fine-tuned YOLOv8 detector, a fast image-recognition model, with an open-weight vision-language model. A router decides which one to trust, based on the detector's confidence.
The authors tested it on 16 puzzle classes. They report 85.4% accuracy over all puzzles. When every class is weighted equally, so that rare puzzle types count as much as common ones, the figure is 84.2%. They say the pair does better than either part alone.
How the learning loop works
The key design choice is that the slow model teaches the fast one. Each answer the vision-language model produces also serves as a training label for the detector. The detector then absorbs puzzle categories it was never trained on. The authors say this typically takes one or two encounters, with no human annotation.
The system also acts like a person at a desk. It works from screenshots and sends input events through the operating system. It does not use browser automation or read the page's underlying code. The abstract does not say how well that approach evades tools that watch for bots.
The arms-race result, and its limits
The most pointed finding concerns defense. A CAPTCHA operator can alter images with tiny deliberate changes designed to fool a specific detector. Against the publicly released detector, the authors say this can drive accuracy to 0%.
Those changes leave the vision-language model untouched. Its labels let the detector retrain and recover. In a simulated year in which the operator re-crafts its changes every month, the solver recovered every round.
The authors add that a cheap teacher, about 70% accurate, hardens the detector as effectively as a perfect oracle. The labels do not need to be right every time for the loop to work.
There are limits. The arms race is a simulation, not a field test against live sites. The attack on the detector assumes the operator can get hold of the released model. The abstract does not say how real CAPTCHA vendors would fare.
What leaders should ask
The authors conclude that visual CAPTCHA defenses assuming a failing bot stays failing "understate how quickly an adaptive solver returns." For an organisation, that is a question about assumptions, not a reason to remove the checks.
Put these questions to your security and fraud teams:
First, what does our CAPTCHA protect, and what happens if it stops working? Second, do we measure bot success over time, or only at the moment we deploy a new challenge? Third, what sits behind the puzzle, such as rate limits, account signals or behavior checks, if a solver adapts? Fourth, does our vendor test against solvers that learn, or against fixed ones?
A puzzle that stops a bot today is a data point. The paper's lesson is that a bot which learns turns that data point into a moving target.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: arXiv (authors of arXiv:2609.02393).
