Pith. sign in

REVIEW 3 major objections 5 minor 49 references

The paper argues that non-interactive defenses like reCAPTCHA v3 are gated by execution-environment authenticity (trusted browser state) rather than by human-like behavior, and that challenge-based CAPTCHAs are effectively dead against cost

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 14:43 UTC pith:PK72TEPM

load-bearing objection Useful measurement study of solver/LLM-agent captcha bypass; RQ3's environment-layer conclusion is underdetermined by the two-agent comparison. the 3 major comments →

arxiv 2607.18659 v1 pith:PK72TEPM submitted 2026-07-21 cs.CR cs.AIcs.MA

Broken Gates: Re-evaluating Web Bot Defenses in the Age of LLM Agents

Behzad Ousat , Nikita Turkmen , Lalchandra Rampersaud , Dillan Bailey , Amin Kharraz This is my paper
classification cs.CR cs.AIcs.MA
keywords bot management systemsCAPTCHA bypassLLM browser agentsreCAPTCHA v3hCaptchaCloudflare Turnstilesolver servicesenvironment authenticity
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper measures whether modern bot-management systems still hold against two kinds of automated attackers: commercial CAPTCHA-solving services and LLM-driven browser agents. It finds that challenge-based defenses (hCaptcha, reCAPTCHA v2, Cloudflare Turnstile) are bypassed almost universally at negligible cost, while non-interactive scorers such as reCAPTCHA v3 resist these attacks. The resistance, however, is not a fundamental security property: two agents with nearly identical interaction traces get opposite outcomes, and the only successful agent runs inside a real browser profile with cookies, history, and stable fingerprints. The paper's central claim is that the security boundary of non-interactive defenses lies at the environment-authenticity layer, not at the behavior or reasoning layer. If true, defenders must shift from making puzzles harder to validating execution contexts and resisting environmental spoofing.

Core claim

The paper's central claim is that the primary barrier to bypassing reCAPTCHA v3 is not generating human-like interactions but operating from a trusted browser environment. In a controlled seven-site testbed, commercial solver services achieved near-perfect success against hCaptcha Easy, both reCAPTCHA v2 variants, and both Turnstile modes, at costs as low as roughly $0.10 per 1,000 solves, but averaged only 23% success against reCAPTCHA v3. Among six LLM-based browser agents, only NanoBrowser, a browser extension running inside a real user profile, consistently passed reCAPTCHA v3. The paper compares NanoBrowser with Browser-Use, whose triggered click, key, and submission events are nearly i

What carries the argument

The load-bearing mechanism is what the paper calls environmental authenticity: the accumulated browser-state and identity signals—persistent cookies, browsing history, installed extensions, and a stable fingerprint—that a real user profile carries and a clean instrumented browser does not. The argument isolates this variable through fine-grained interaction trace analysis: the instrumentation collects click, keyboard, mouse, and submission events during login-form sessions, and the comparison of two agents with near-identical event traces is used to attribute the divergent outcomes to environment rather than behavior. The testbed itself, seven public subdomains running the same login form be

Load-bearing premise

The load-bearing premise is that Browser-Use and NanoBrowser differ only in environmental authenticity: they also differ in deployment mode, codebase, browser controller, and LLM backend, and if any of those confounds drives the outcome, the environment-layer conclusion does not follow.

What would settle it

Take the failing agent (Browser-Use) and run it inside an authentic, pre-aged browser profile with cookies, history, and stable fingerprints without changing any other component; if reCAPTCHA v3 still scores it below 0.5, environmental authenticity alone is not sufficient to explain the difference.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Challenge-based CAPTCHAs no longer impose meaningful friction: commercial solvers achieve near-100% success on hCaptcha Easy, reCAPTCHA v2, and Turnstile at costs as low as $0.10 per 1,000 solves.
  • The apparent strength of reCAPTCHA v3 comes from environmental authenticity, not from the difficulty of acting human; any agent operating from a trusted browser profile can pass without producing specially human-like behavior.
  • LLM-based agents fail against interactive challenges mainly because they lack a dedicated solver module, not because they cannot reason about the page; adding such a module flips the outcome.
  • For defenders, the security boundary is the environment layer, so durable bot management depends on server-side validation and resistance to browser-state spoofing rather than on interaction complexity alone.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the environment-layer conclusion holds, the effective cost of bypassing reCAPTCHA v3 becomes the cost of obtaining or faking a trusted browser profile; a testable next step is whether shared or cloned profiles defeat the defense at scale, which would make authenticity a scarce but purchasable resource.
  • The RQ3 comparison leaves confounds: Browser-Use and NanoBrowser differ not only in environmental authenticity but also in deployment mode, browser controller, codebase, and LLM backend; ruling these out requires varying only the profile within the same agent stack.
  • The paper's evidence points toward an arms race: defenders will push validation deeper into server-side and backend-token checks that cannot be satisfied by a copied profile, moving the battle from interaction generation to identity and provenance.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper reports a measurement study of web bot defenses against two attacker classes: seven commercial captcha-solving services and six LLM-based browser agents across hCaptcha, reCAPTCHA v2, reCAPTCHA v3, and Cloudflare Turnstile. The empirical claims are: (1) commercial solvers achieve near-perfect bypass of challenge-based defenses at negligible cost, but only 23% success on reCAPTCHA v3; (2) LLM agents generally fail on challenge-based defenses unless they have a dedicated solver module, and also fail on non-interactive defenses even when completing the underlying workflow; (3) reCAPTCHA v3's resistance is not a fundamental security property but is determined by execution-environment authenticity, supported by a comparison of two agents (Browser-Use and NanoBrowser) with 'nearly indistinguishable' traces but divergent outcomes. The paper concludes that the security boundary of non-interactive defenses lies at the environment layer.

Significance. If the central RQ3 claim held, the paper would be an important, timely measurement contribution: it would show that challenge-based captchas are commoditized and that non-interactive defenses, specifically reCAPTCHA v3, are not robust against adversaries that operate from authentic browser environments. The paper has clear strengths: a controlled public testbed with vendor-verified tokens, a broad sweep of real solver services, cost data, and a two-phase evaluation protocol. The RQ1/RQ2 results, especially the near-perfect solver performance on challenge-based systems, are plausible and useful. However, the RQ3 'environment-layer' conclusion is load-bearing and currently rests on a confounded two-system comparison rather than on a controlled isolation of the environment variable. The paper needs additional experimental work to support its headline claim; the present evidence is not sufficient to support the strong conclusion as written.

major comments (3)
  1. [§5.3, Figure 5] The central claim that 'the primary barrier to bypassing reCaptcha v3 is ... the ability to operate from a trusted browser environment' rests on the comparison between Browser-Use and NanoBrowser. These two systems differ not only in environmental authenticity but also in deployment mode (clean instrumented browser vs. browser extension in a real profile), codebase, browser controller, LLM backend, and instrumentation level. Figure 5 shows only aggregate counts of event types (click, keydown, mousemove, etc.) and total interaction time; it does not show timing distributions, inter-event intervals, mouse trajectories, or lower-level JavaScript/fingerprinting signals that reCAPTCHA v3 likely consumes. The statement that the traces are 'nearly indistinguishable' is therefore only about a coarse event-type histogram, not about behavioral equivalence at the granularity the defense evaluates.
  2. [§5.2, Table 3 and §5.3] The evaluation protocol uses a screening phase of five attempts and a second phase of ten additional trials only for configurations that showed promise; success is marked if the agent succeeds in at least one attempt in each phase. Table 3 reports only binary symbols, not per-trial counts, repeatability data, or confidence intervals. This is especially problematic for the RQ3 conclusion: the paper states that NanoBrowser 'consistently achieves bypass' and that Browser-Use 'consistently receives low trust scores (0.1–0.3),' but no raw score distributions or trial counts are provided. Without these numbers, the reader cannot assess the strength of the quantitative claim or the variability across runs. The authors should report the number of trials per configuration, the per-trial reCAPTCHA v3 scores, and, where applicable, confidence intervals or at least success counts.
  3. [§5.2/§5.3 score reporting] The paper uses a lenient success criterion ('bypass achieved in at least one attempt in each phase') to classify a configuration as successful. For challenge-based systems, this is reasonable under a retry-until-success adversarial model, but for reCAPTCHA v3 the outcome is a continuous score, and the text reports only qualitative bands ('0.1–0.3') for failing agents. Since the acceptance threshold (0.5) is a free parameter and scores may be sensitive to it, the authors should present the raw score distributions for each agent and, if possible, a sensitivity analysis around the threshold. This would also help separate 'environment authenticity' from 'just-above-threshold' effects.
minor comments (5)
  1. [§5.2, Comet sentence] Grammatical issue: 'Comet declined to fill in or submit login forms containing, citing concerns...' appears to have an incomplete object. Should read something like '...login forms containing credentials, citing...'.
  2. [Throughout] Repeated typo: 'challenged-based' should be 'challenge-based'. Also, Table 1 caption and reference [4] misspell 'SimilarWeb' as 'SimiliarWeb'.
  3. [Figure 5] Figure 5 is described as a 'heatmap' but in the rendered table it appears as raw counts with no color scale. Include a legend or color scale, and clarify that the numbers are counts of triggered events, not densities or rates.
  4. [§4.4] The two requirements introduced (authenticity and behavioral realism) are intuitive but not precisely defined. A concrete operational definition of each, with examples of what signals they comprise, would strengthen the framework and make the RQ3 discussion more rigorous.
  5. [§5.1, Table 2] The reCAPTCHA v3 row reports a per-service breakdown, but the average 23% is computed over seven services. Clarify whether the average is weighted equally or across the different success rates, and consider noting which services did not return verifiable tokens at all.

Circularity Check

0 steps flagged

No significant circularity; the central claims are empirical measurements against external vendor services rather than quantities derived from their own inputs.

full rationale

Walking the claimed derivation chain: RQ1 results are measured by submitting solver tokens to the vendors' official verification endpoints; RQ2 results are observed pass/fail outcomes against live third-party defenses; RQ3 is an interaction-trace comparison between Browser-Use and NanoBrowser. None of these conclusions is defined in terms of its own output. The reCAPTCHA v3 score is not computed from any parameter fitted by this paper, and no fitted quantity is renamed as a prediction. The 'environment authenticity' interpretation in Section 5.3 is an inference from a measured outcome difference, not an assumption built into the data collection or an equation that reduces to the conclusion. The only self-citation, [30], is used in Section 2.2 as background evidence about solver-plus-crawler pipelines; it does not carry the RQ1-RQ3 results and is not used to assert a uniqueness theorem or to rule out alternative explanations. The main caveat is causal, not circular: Browser-Use and NanoBrowser differ in deployment mode, codebase, LLM backend, and profile state, so the claim that their comparison 'isolates the variable of interest' is underdetermined. That is a validity concern about the natural experiment, but the outcome was not constructed to equal the paper's conclusion. No circular step is present.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

No new entities, forces, or mediators are introduced. 'Environment authenticity' is a label for observed browser-state signals, not an invented object. The load-bearing assumptions are about representativeness of the testbed, the sufficiency of event-count similarity, the acceptance threshold, and the reliability of vendor verification APIs. The only hand-set numeric choices are the success criterion and the 0.5 score threshold.

free parameters (2)
  • LLM agent success criterion = at least one successful bypass per evaluation phase
    Hand-set in §5.2: a configuration is marked successful if the agent bypasses at least once in the 5-trial screening phase and at least once in the 10-trial expansion. This lenient criterion can overstate capability for stochastic challenge content.
  • reCAPTCHA v3 acceptance threshold = score > 0.5
    Google's documented default threshold is used as the success boundary in §5.1. It is not fitted to the data, but it is a hand-chosen operationalization that affects all v3 success rates.
axioms (4)
  • domain assumption The controlled public testbed is representative of real production deployments of these defenses.
    §4.1: seven self-hosted subdomains with six months of public exposure and periodic benign interactions. Low-traffic test domains may have different reputation and risk calibration than popular production sites.
  • domain assumption Event-count-level behavioral similarity is sufficient to conclude behavioral indistinguishability.
    §5.3 and Figure 5 compare coarse event-type frequencies (clicks, keydowns, mousemoves, etc.) rather than timing distributions, trajectories, or JS-visible artifacts. The 'nearly indistinguishable traces' premise depends on this assumption.
  • domain assumption reCAPTCHA v3's default 0.5 score threshold reflects the defender's acceptance boundary.
    §5.1: the paper follows Google's deployment recommendation. Production sites often use site-specific thresholds, so results may not generalize to stricter or looser deployments.
  • domain assumption Official vendor verification APIs provide reliable ground truth for token validity.
    §5.1: hCaptcha siteverify, Google reCAPTCHA verification API, and Cloudflare Turnstile endpoints are used as ground truth. This treats vendor endpoints as correct, which is reasonable but unverified internally.

pith-pipeline@v1.3.0-alltime-deepseek · 14136 in / 13014 out tokens · 113855 ms · 2026-08-01T14:43:06.957474+00:00 · methodology

0 comments
read the original abstract

LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language instructions. This evolution raises fundamental questions about the effectiveness of bot management systems, widely deployed to defend against automated web abuse. In this paper, we present a systematic measurement study evaluating the resilience of both interactive challenge-based defenses and non-interactive trust-based defenses against two attacker classes: commercial Captcha-solving services and LLM-based browser agents. Our evaluation spans seven solver services and six agents, including cloud-hosted, self-hosted, AI-assisted, and browser-extension configurations, tested against hCaptcha, reCaptcha v2, reCaptcha v3, and Cloudflare Turnstile. Our results show that challenge-based defenses are broadly ineffective against commercial solvers, which achieve near-perfect bypass at negligible cost. The challenges can similarly be defeated by LLM-based agents when a dedicated solver module is available. Non-interactive defenses such as reCaptcha v3 exhibit stronger resistance, but our analysis reveals that this resilience does not reflect a fundamental security property. Through fine-grained interaction trace analysis, we find that two agents with nearly indistinguishable behavioral footprints yield divergent outcomes, one bypassing the defense and one failing, isolating execution-environment authenticity, rather than agent behavior, as the determining factor. These findings suggest that the security boundary of non-interactive defenses lies at the environment layer, with significant implications for how bot management systems are designed and evaluated.

Figures

Figures reproduced from arXiv: 2607.18659 by Amin Kharraz, Behzad Ousat, Dillan Bailey, Lalchandra Rampersaud, Nikita Turkmen.

Figure 1
Figure 1. Figure 1: LLM-based Browser Agents Workflow Diagram. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Sample Login Pages Protected with hCaptcha and [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Prompt used to instruct the LLM-based browser [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Samples of visual puzzles encountered during [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Interaction Event Heatmap for Browser-Use and [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

49 extracted references · 6 linked inside Pith

  1. [1]

    https: //developers.google.com/recaptcha/docs/ display

    reCAPTCHA v2: I’m not a robot. https: //developers.google.com/recaptcha/docs/ display. Accessed: 2026-04-28

    2026

  2. [2]

    https://developers.google

    reCAPTCHA v3. https://developers.google. com/recaptcha/docs/v3. Accessed: 2026-04-28

    2026

  3. [3]

    https://www.google.com/recaptcha/about/

    Stop automated attacks with modern bot protection. https://www.google.com/recaptcha/about/. Ac- cessed: 2026-06-06

    2026

  4. [4]

    https://lp.similarweb

    Website traffic analysis. https://lp.similarweb. com/website-traffic-checker-2/ . Accessed: 2026-06-06

    2026

  5. [5]

    https://www

    hCaptcha: Stop bots, humanize the web. https://www. hcaptcha.com, 2024. Accessed: 2026-04-28

    2024

  6. [6]

    https: //developers.cloudflare.com/turnstile/, 2024

    Turnstile: A CAPTCHA alternative. https: //developers.cloudflare.com/turnstile/, 2024. Accessed: 2026-04-28

    2024

  7. [7]

    Digital fortresses under siege: Threats to modern application architectures

    Akamai Technologies. Digital fortresses under siege: Threats to modern application architectures. Technical report, Akamai, 2024

    2024

  8. [8]

    By- passing audio reCAPTCHA with automatic speech recognition models

    Paul Aubry, Juliette Devoivre, Damien Carron, Simon Fernandez, Andrzej Duda, and Maciej Korczy´nski. By- passing audio reCAPTCHA with automatic speech recognition models. In2025 IEEE European Sympo- sium on Security and Privacy Workshops (EuroS&PW). IEEE, 2025

    2025

  9. [9]

    Detecting imap credential stuffing bots using behavioural biometrics

    Ashley Barkworth, Rehnuma Tabassum, and Arash Habibi Lashkari. Detecting imap credential stuffing bots using behavioural biometrics. InProceedings of the 2022 12th International Conference on Communica- tion and Network Security, pages 7–15, 2022

    2022

  10. [10]

    browser-use: Make any website accessible for AI agents

    browser-use. browser-use: Make any website accessible for AI agents. https://github.com/browser-use/ browser-use, 2024. Accessed: 2026-04-28

    2024

  11. [11]

    BrowserOS: LLM-powered browser au- tomation framework

    BrowserOS. BrowserOS: LLM-powered browser au- tomation framework. https://www.browseros.com/,

  12. [12]

    Oedipus: Llm-enchanced reason- ing captcha solver.arXiv preprint arXiv:2405.07496, 2024

    Gelei Deng, Haoran Ou, Yi Liu, Jie Zhang, Tianwei Zhang, and Yang Liu. Oedipus: Llm-enchanced reason- ing captcha solver.arXiv preprint arXiv:2405.07496, 2024

    Pith/arXiv arXiv 2024

  13. [13]

    Illusioncaptcha: A captcha based on visual illusion.arXiv preprint arXiv:2502.05461, 2025

    Ziqi Ding, Gelei Deng, Yi Liu, Junchen Ding, Jieshan Chen, Yulei Sui, and Yuekang Li. Illusioncaptcha: A captcha based on visual illusion.arXiv preprint arXiv:2502.05461, 2025. 11

    Pith/arXiv arXiv 2025

  14. [14]

    Sok: Ma- chine vs

    Antreas Dionysiou and Elias Athanasopoulos. Sok: Ma- chine vs. machine–a systematic classification of auto- mated machine learning-based captcha solvers.Com- puters & Security, 97:101947, 2020

    2020

  15. [15]

    The history of digital spam.Communi- cations of the ACM, 62(8):82–91, 2019

    Emilio Ferrara. The history of digital spam.Communi- cations of the ACM, 62(8):82–91, 2019

    2019

  16. [16]

    Demystifying the underground ecosys- tem of account registration bots

    Yuhao Gao, Guoai Xu, Li Li, Xiapu Luo, Chenyu Wang, and Yulei Sui. Demystifying the underground ecosys- tem of account registration bots. InProceedings of the 30th ACM Joint European Software Engineering Con- ference and Symposium on the Foundations of Software Engineering, pages 897–909, 2022

    2022

  17. [17]

    reCAPTCHA v3: Verify requests without user interaction

    Google. reCAPTCHA v3: Verify requests without user interaction. https://developers.google.com/ recaptcha/docs/v3, 2023. Accessed: 2026-04-28

    2023

  18. [18]

    How secure is your website? a com- prehensive investigation on captcha providers and solv- ing services.arXiv preprint arXiv:2306.07543, 2023

    Rui Jin, Lin Huang, Jikang Duan, Wei Zhao, Yong Liao, and Pengyuan Zhou. How secure is your website? a com- prehensive investigation on captcha providers and solv- ing services.arXiv preprint arXiv:2306.07543, 2023

    Pith/arXiv arXiv 2023

  19. [19]

    2025 account takeover attack trends report

    Kasada. 2025 account takeover attack trends report. Technical report, Kasada, February 2025. Based on infiltration of 22 active credential stuffing groups

    2025

  20. [20]

    Web scraping or web crawling: State of art, techniques, approaches and application.In- ternational Journal of Advances in Soft Computing & Its Applications, 13(3), 2021

    Moaiad Ahmad Khder. Web scraping or web crawling: State of art, techniques, approaches and application.In- ternational Journal of Advances in Soft Computing & Its Applications, 13(3), 2021

    2021

  21. [21]

    Un- invited guests: Analyzing the identity and behavior of certificate transparency bots

    Brian Kondracki, Johnny So, and Nick Nikiforakis. Un- invited guests: Analyzing the identity and behavior of certificate transparency bots. In31st USENIX Security Symposium (USENIX Security 22), pages 53–70, 2022

    2022

  22. [22]

    Human-aided bots.IEEE Internet Computing, 22(6):36–43, 2018

    Pavel Kucherbaev, Alessandro Bozzon, and Geert-Jan Houben. Human-aided bots.IEEE Internet Computing, 22(6):36–43, 2018

    2018

  23. [23]

    Good bot, bad bot: Characterizing auto- mated browsing activity

    Xigao Li, Babak Amin Azad, Amir Rahmati, and Nick Nikiforakis. Good bot, bad bot: Characterizing auto- mated browsing activity. In2021 IEEE symposium on security and privacy (sp), pages 1589–1605. IEEE, 2021

    2021

  24. [24]

    WebCloak: Characterizing and mitigating threats from LLM-driven web agents as intelligent scrapers

    Xinfeng Li, Tianze Qiu, Yingbin Jin, Lixu Wang, Han- qing Guo, Xiaojun Jia, XiaoFeng Wang, and Wei Dong. WebCloak: Characterizing and mitigating threats from LLM-driven web agents as intelligent scrapers. In2026 IEEE Symposium on Security and Privacy (SP). IEEE, 2026

    2026

  25. [25]

    Open captchaworld: A comprehensive web-based platform for testing and benchmarking multimodal llm agents.arXiv preprint arXiv:2505.24878, 2025

    Yaxin Luo, Zhaoyi Li, Jiacheng Liu, Jiacheng Cui, Xi- aohan Zhao, and Zhiqiang Shen. Open captchaworld: A comprehensive web-based platform for testing and benchmarking multimodal llm agents.arXiv preprint arXiv:2505.24878, 2025

    Pith/arXiv arXiv 2025

  26. [26]

    Manus: General-purpose AI agent

    Manus. Manus: General-purpose AI agent. https: //manus.im, 2025. Accessed: 2025

    2025

  27. [27]

    OpenManus: An open-source frame- work for general AI agents

    ManusAgent. OpenManus: An open-source frame- work for general AI agents. https://github.com/ FoundationAgents/OpenManus, 2025. Accessed: 2026-04-28

    2025

  28. [28]

    Re:{CAPTCHAs—Understanding}{CAPTCHA- Solving} services in an economic context

    Marti Motoyama, Kirill Levchenko, Chris Kanich, Da- mon McCoy, Geoffrey M V oelker, and Stefan Sav- age. Re:{CAPTCHAs—Understanding}{CAPTCHA- Solving} services in an economic context. In19th USENIX Security Symposium (USENIX Security 10), 2010

    2010

  29. [29]

    nanobrowser: Open-source Chrome ex- tension for AI-powered web automation

    nanobrowser. nanobrowser: Open-source Chrome ex- tension for AI-powered web automation. https:// github.com/nanobrowser/nanobrowser, 2024. Ac- cessed: 2026-04-28

    2024

  30. [30]

    The matter of captchas: An analysis of a brittle security feature on the modern web

    Behzad Ousat, Esteban Schafir, Duc C Hoang, Moham- mad Ali Tofighi, Cuong V Nguyen, Sajjad Arshad, Sel- cuk Uluagac, and Amin Kharraz. The matter of captchas: An analysis of a brittle security feature on the modern web. InProceedings of the ACM Web Conference 2024, pages 1835–1846, 2024

    2024

  31. [31]

    Comet: Browse at the speed of thought

    Perplexity AI. Comet: Browse at the speed of thought. https://www.perplexity.ai/hub/blog/ introducing-comet, July 2025. Accessed: 2025

    2025

  32. [32]

    Effective bot management strategies for web applications

    Sanjeev Pratap Singh and Naveed Afzal. Effective bot management strategies for web applications. In2024 International Symposium on Intelligent Robotics and Systems (ISoIRS), pages 314–322. IEEE, 2024

    2024

  33. [33]

    I’m not a human: Breaking the google re- captcha.Black Hat, 14:1–12, 2016

    Suphannee Sivakorn, Jason Polakis, and Angelos D Keromytis. I’m not a human: Breaking the google re- captcha.Black Hat, 14:1–12, 2016

    2016

  34. [34]

    Best way to bypass captcha for ai browser automation (september 2025), 2025

    Skyvern. Best way to bypass captcha for ai browser automation (september 2025), 2025. Accessed: 2026- 04-28

    2025

  35. [35]

    Skyvern: Automate browser-based work- flows using LLMs and computer vision

    Skyvern-AI. Skyvern: Automate browser-based work- flows using LLMs and computer vision. https:// github.com/Skyvern-AI/skyvern, 2024. Accessed: 2026-04-28

    2024

  36. [36]

    Credential stuffing in 2026: What startup teams need to know, March 2026

    StartupDefense. Credential stuffing in 2026: What startup teams need to know, March 2026. Cites Re- liaQuest 2025 and SpyCloud 2025 on OpenBullet 2 and CAPTCHA solver integration. 12

    2026

  37. [37]

    Mengyun Tang, Haichang Gao, Yang Zhang, Yi Liu, Ping Zhang, and Ping Wang. Research on deep learn- ing techniques in breaking text-based captchas and de- signing image-based captcha.IEEE Transactions on Information Forensics and Security, 13(10):2522–2537, 2018

    2018

  38. [38]

    Are captchas still bot-hard? generalized visual captcha solving with agentic vision language model.34th USENIX Security Symposium (USENIX Security 25), 2025

    Xiwen Teoh, Yun Lin, Siqi Li, Ruofan Liu, Avi Sol- lomoni, Yaniv Harel, and Jin Song Dong. Are captchas still bot-hard? generalized visual captcha solving with agentic vision language model.34th USENIX Security Symposium (USENIX Security 25), 2025

    2025

  39. [39]

    Captcha me if you can: Imitation games with reinforcement learning

    Ilias Tsingenopoulos, Davy Preuveneers, Lieven Desmet, and Wouter Joosen. Captcha me if you can: Imitation games with reinforcement learning. In2022 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2022

    2022

  40. [40]

    Credential stuffing attacks: Addi- tional 2025 DBIR research

    Verizon Business. Credential stuffing attacks: Addi- tional 2025 DBIR research. Technical report, Verizon,

    2025

  41. [41]

    Bot or human? detecting chatgpt imposters with a single question.arXiv preprint arXiv:2305.06424, 2023

    Hong Wang, Xuan Luo, Weizhi Wang, and Xifeng Yan. Bot or human? detecting chatgpt imposters with a single question.arXiv preprint arXiv:2305.06424, 2023

    Pith/arXiv arXiv 2023

  42. [42]

    Supplemental research to the 2025 Data Breach Investigations Report

    2025

  43. [43]

    Monitoring servers, with a little help from my bots

    Takashi Yamanoue. Monitoring servers, with a little help from my bots. InProceedings of the 2017 ACM SIGUCCS Annual Conference, pages 173–180, 2017

    2017

  44. [44]

    Towards understanding the security of modern image captchas and underground captcha-solving services.Big Data Mining and Analytics, 2(2):118–144, 2019

    Haiqin Weng, Binbin Zhao, Shouling Ji, Jianhai Chen, Ting Wang, Qinming He, and Raheem Beyah. Towards understanding the security of modern image captchas and underground captcha-solving services.Big Data Mining and Analytics, 2(2):118–144, 2019

    2019

  45. [45]

    Yet another text captcha solver: A generative adversarial network based approach

    Guixin Ye, Zhanyong Tang, Dingyi Fang, Zhanxing Zhu, Yansong Feng, Pengfei Xu, Xiaojiang Chen, and Zheng Wang. Yet another text captcha solver: A generative adversarial network based approach. InProceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 332–348, 2018

    2018

  46. [46]

    Agentic web: Weaving the next web with ai agents.arXiv preprint arXiv:2507.21206, 2025

    Yingxuan Yang, Chen Zheng, Le Zheng, Yan Xi, Wei Du, Zhenxi Lin, Esha Ghosh, Haoran Wang, Zekun Liu, Ziwei Huang, Jialu Li, Jiaming Song, Jimeng Sun, Pin-Yu Chen, Jie Tang, and Ce Zhang. Agentic web: Weaving the next web with ai agents.arXiv preprint arXiv:2507.21206, 2025

    Pith/arXiv arXiv 2025

  47. [47]

    GPT-4V(ision) is a generalist web agent, if grounded

    Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. GPT-4V(ision) is a generalist web agent, if grounded. InProceedings of the 41st International Conference on Machine Learning (ICML), 2024. 13

    2024

  48. [48]

    Ning Zhang, Mohammadreza Ebrahimi, Weifeng Li, and Hsinchun Chen. Counteracting dark web text-based captcha with generative adversarial learning for proac- tive cyber threat intelligence.ACM Transactions on Management Information Systems (TMIS), 13(2):1–21, 2022

    2022

  49. [2025]

    Accessed: 2026-04-28

    2026