PaperlayerView exact revision on arXiv

Source-linked AI summary

Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot

Suphannee Sivakorn, Samantha Gottlieb

arXiv:2609.18518v1cs.CR

TL;DR

This paper asks whether free, locally run models can break Google reCAPTCHA without training or API access, and whether natural-language instructions alone can suffice. It develops zero-shot solvers for the challenge types and reports 92.6% session success across 500 real-world sessions. The authors also identify session timeouts as a limitation for dynamic or high-volume challenges.

  • Problem

    The paper asks whether free, open-source local vision models can break Google reCAPTCHA without API costs or training, and whether natural-language instructions to an AI assistant suffice.

    Source: §1 · p. 2

  • Method

    The authors build zero-shot, open-source local solvers using CLIP for Type A and OWLv2 for Type B, with no training or API access.

    Source: §1 · p. 2

  • Results

    92.6% session success across 500 real-world reCAPTCHA sessions was achieved, alongside 58.0% Type A and 43.5% Type B per-challenge accuracy.

    Source: §7 · p. 19

  • Takeaways & Limitations

    The authors conclude that visual task difficulty no longer reliably separates humans from machines, and that a non-technical adversary can defeat reCAPTCHA using a commodity AI assistant.

    Source: §7 · p. 19

    Dynamic challenges and high-volume Type B challenges can time out because per-challenge inference takes 38.4–83.7 seconds on average and up to 276.9 seconds.

    Source: §4.2 · p. 16

Abstract

from arXiv · show

Google reCAPTCHA is the most widely deployed visual CAPTCHA service, protecting hundreds of thousands of websites from automated bots. It serves as a critical line of defense against automated attacks, including credential stuffing, bulk account creation, and automated form abuse. It has proven largely effective since its introduction in 2007. However, the rise of accessible AI now threatens its efficacy. Prior work has demonstrated that commercial cloud-based vision-language models (VLMs) can solve visual CAPTCHA challenges, but at non-trivial monetary cost per attempt. In this paper, we show that free and locally-run models can break Google reCAPTCHA. We conduct a comprehensive study of reCAPTCHA and present a taxonomy of its challenge types: Type A (independent image tiles, with static and dynamic sub-variants) and Type B (a single image partitioned into a 4x4 grid), each demanding a distinct solving strategy. We design zero-shot, no-cost solvers built entirely on open-source local models, specifically CLIP (58% per-challenge accuracy on Type A) and OWLv2 (43.5% on Type B), requiring no model training and no API access. Our end-to-end automated solver achieves a 92.6% per-session success rate across 500 real-world reCAPTCHA sessions. We further demonstrate that reCAPTCHA can be defeated by a non-technical adversary, using only natural-language instructions to a commodity AI assistant. This collapses the practical attacker skill floor to near zero and fundamentally changes the threat model for challenge-based CAPTCHAs. Although reCAPTCHA increasingly favors reputation-based verification, visual challenge-based fallback persists as a safety net that, paradoxically, has become the weakest link in the defense chain, suggesting that challenge-based visual CAPTCHAs may have reached the end of their useful life.

1 Introduction

CAPTCHAs must deter automated abuse while remaining usable for people, but accessible AI challenges the assumption that visual recognition remains bot-hard. This paper asks whether local, free models and natural-language instructions alone can break reCAPTCHA, and reports affirmative results.

Motivation

  • CAPTCHAs address automated credential stuffing, scraping, and account takeovers, while even simple challenges deter some legitimate users.The introduction frames the problem as balancing bot resistance with effortless human use.Source: §1 · p. 2

Research questions

  • The paper asks whether free, open-source local vision models can break Google reCAPTCHA without API costs or training, and whether natural-language instructions alone suffice.The motivating security challenge is to resist automated bots without making CAPTCHA completion burdensome for legitimate users.Source: §1 · p. 2

Contributions

  • 92.6% session success across 500 real-world reCAPTCHA sessions was achieved by an end-to-end solver using zero-shot, open-source local models.CLIP reached 58% per-challenge accuracy on Type A and OWLv2 43.5% on Type B, without training or API access.Source: §1 · p. 2
  • A non-technical adversary can defeat reCAPTCHA using only natural-language instructions to a commodity AI assistant.The authors say this brings the attacker skill floor near zero and changes the threat model for challenge-based CAPTCHAs.Source: §1 · p. 3

2 Background

The background describes how reCAPTCHA escalates users to visual challenges, distinguishes two challenge formats, and situates the work among prior CAPTCHA solvers and AI-assisted attacks.

2.1 Google reCAPTCHA v2 and v3

  • reCAPTCHA v2 and v3 use reputation signals to decide whether to show a visual challenge, and the experiments use fresh, unsigned-in sessions to ensure challenges appear.High-reputation users may bypass challenges; v2 sessions can expire after about two minutes without submission.Source: §2.1 · pp. 3–4

2.2 reCAPTCHA Visual Challenge Types

  • Type A uses nine independent images in a 3×3 grid, with static and dynamic variants, while Type B uses one image split into 16 spatial crops in a 4×4 grid.Dynamic Type A tiles refresh after correct selections; Type B is static and must be solved in one pass.Source: §2.2 · p. 4, Figure 3 · p. 5, Figure 4 · p. 5

2.3 Image CAPTCHA Solving

  • Prior CAPTCHA solvers use labeled-data training, fixed object classes, or paid cloud APIs; this work presents local, open-vocabulary zero-shot models without those dependencies.Earlier reCAPTCHA attacks included CNN annotation, fine-tuned YOLOv8, and Halligan using a cloud API.Source: §2.3 · pp. 5–6

2.4 AI Vision-Language Models

  • CLIP scores an independent image against text labels, whereas OWLv2 localizes queried objects with bounding boxes, matching the distinct demands of Type A and Type B.The paper selects lightweight models to avoid fine-tuning, heavy compute, and commercial API access; larger local multimodal models are described as requiring substantial GPU memory.Source: §2.4 · pp. 6–7

2.5 Agentic AI for Offensive Security

  • Prior AI-assisted security work includes agents that reason over system state and chain reconnaissance, exploitation, and post-exploitation steps.The authors place their AI-generated solver and no-code prompt-only solver in this broader context of lowering the technical barrier to attack tooling.Source: §2.5 · p. 7

3 Methodology

The methodology isolates visual challenge solving from reputation effects, builds an offline labeled challenge set, and uses type-specific solvers within an automated online workflow.

3 Methodology

  • Selenium provides browser automation for navigating reCAPTCHA pages and interacting with their elements.Source: §3 · p. 7

3.1 Experimental Isolation

  • Fresh, unsigned browser profiles with no browsing history ensure sessions receive visual challenges and measure image-classification performance rather than reputation-based bypasses.Source: §3.1 · p. 8

3.2 Challenge Data Collection

  • The crawler collected 1,000 manually labeled challenges—662 Type A and 338 Type B—from deployed reCAPTCHA sites, spanning 13 keywords, with five transportation keywords accounting for over 76%.Labels were used to select models and tune parameters, not for training; the remaining six keywords appeared less frequently.Source: §3.2 · p. 8

3.3 Offline Challenge Solver

  • Type A uses zero-shot per-tile CLIP classification with a tuned contrastive-score threshold, while Type B uses OWLv2 detections on the full image mapped onto grid tiles.The Type B method addresses spatial layout, for which per-tile CLIP classification achieves 12.7% accuracy versus OWLv2’s 43.5%.Source: Local Vision Models · p. 9
  • For Type B, confidence and coverage thresholds filter detections and tile overlaps, but coarse boxes can select tiles without the target; SAM improved accuracy only 1–2% while substantially increasing inference time.Source: Local Vision Models · p. 10

3.4 Online Challenge Solver

  • The online solver detects challenge variants, loops through refreshed tiles for dynamic Type A challenges, submits answers, and retries until a terminal state or 20 attempts.Repeated clicks toggle selection, so already-selected tiles must not be clicked again.Source: Challenge Variant Detection and Solving · p. 11
  • Prompt-only classification averages 38.4–83.7 seconds per challenge and can take 276.9 seconds, risking expiry of sessions with a roughly two-minute limit.Source: Prompt-Only Skill · p. 12

4 Evaluation

The evaluation tests offline per-challenge accuracy and live-session performance, then examines costs and how the two settings differ. The local-model solver succeeds in 92.6% of 500 sessions, while challenge type, latency, and evaluation criteria shape the results.

4.1 Offline Challenge Accuracy

  • 58% was CLIP’s best offline accuracy on Type A; increasing model size sevenfold from ViT-B/32 to ViT-H/14 gained only 6 points.The approximately 58% ceiling reflects ambiguous boundary tiles and implicit size and visibility thresholds that threshold tuning cannot resolve.Source: §4.1 · p. 12, Table 2 · p. 13
  • On Type B challenges, OWLv2 reached its best accuracy of 43.5% at a 10% coverage threshold; per-tile CLIP reached 12.7% at its optimal 0.03 threshold, a 3.4× gap.Source: §4.1 · p. 13
  • The prompt-only skill achieved 95.5% on Type A and 50.5% on Type B offline, but required a paid Claude subscription.Type B errors often differed by one to three boundary tiles; the sixteen-tile grid requires finer localization than Type A’s nine tiles.Source: §4.1 · pp. 13–14
  • Type A challenges cost an average $0.150 per Claude Code challenge, and Type B challenges $0.268, with higher token usage for Type B.Multiple tool turns re-incur prompt and tool-definition overhead; failed 20-challenge sessions could cost approximately $2–13 in tokens.Source: §4.1 · p. 14

4.2 Online Session Accuracy

  • 92.6% of 500 real-world sessions succeeded; successful sessions took a median 57 seconds and 3 challenges, while failures reached a median 20 challenges and 278 seconds.Failures were attributed to reCAPTCHA sustaining suspicion and serving challenges until the attempt limit, rather than to misclassification.Source: §4.2 · p. 15, Table 5 · p. 15, Figure 6 · p. 15
  • Sessions with only Type A challenges succeeded at 99.5%, while sessions with at least 50% Type B challenges succeeded at 85.8–88.4%.The paper identifies Type B as the primary failure driver and relates the pattern to OWLv2’s 43.5% offline Type B accuracy.Source: §4.2 · p. 15, Table 6 · p. 16

4.4 Summary

  • Offline accuracy requires exact tile matches, whereas online success uses reCAPTCHA’s more relaxed acceptance criteria, making offline figures conservative lower bounds on real-world performance.The online measure is per session, which can include multiple challenges; the offline measure is per challenge.Source: §4.4 · pp. 16–17

5 Implications for CAPTCHA Security

The paper argues that accessible AI has undermined the bot-hard assumption behind visual image challenges. It also reports a no-code attack path and describes disclosure and safeguards for the study.

5.1 Bots Now Always Win.

  • Under an independence assumption, five attempts at 43.5% per-challenge accuracy yield an estimated 94.3% chance of at least one success; the authors distinguish this simplified model from measured sessions.The online evaluation measured a 92.6% per-session success rate under reCAPTCHA’s actual retry and risk-scoring behavior.Source: §5.1 · pp. 17–18
  • The prompt-only approach uses natural-language instructions without code, machine-learning knowledge, or external services, reducing the stated skill barrier to near zero.The paper describes this as a working solver accessible to users with an AI assistant.Source: §5.1 · p. 18
  • The authors warn that visual challenge fallback remains exploitable for low-reputation sessions even as behavior-based verification avoids challenges for most users.They describe this fallback as a predictable attack path for bots escalated after behavioral analysis.Source: §5.1 · p. 18

5.2 Responsible Disclosure and Ethics

  • The authors disclosed the findings to Google before publication and withheld the end-to-end online solver to limit misuse.Experiments used fresh, unauthenticated sessions and no user data.Source: §5.2 · p. 18

6 Reproducibility Statement

The reproducibility statement identifies public sources for the labeled challenge dataset and the prompt used in the prompt-only evaluation.

6 Reproducibility Statement

  • The labeled challenge dataset and prompt-only classification prompt are publicly available through the cited repository, with the dataset also mirrored on Kaggle.The statement also points to video demonstrations of the online solver.Source: §6 · p. 18

7 Conclusion

The study distinguishes two visual challenge types that require different solving strategies, reports strong end-to-end reCAPTCHA session success, and argues that task-based verification faces a broader challenge from AI.

7 Conclusion

  • 92.6% session success across 500 real-world reCAPTCHA sessions was achieved by the end-to-end automated solver.The solver was built on the paper’s local models.Source: §7 · p. 19
  • Type A independent image tiles and Type B single-image grids require fundamentally different solving strategies.The paper reports 58.0% per-challenge accuracy for CLIP on Type A and 43.5% for OWLv2 on Type B, with no training or API cost.Source: §7 · p. 19
  • The authors argue that visual-recognition or other task-based challenges no longer reliably separate humans from machines, and that challenge-based verification may be unlikely to recover.They point to a non-technical adversary defeating reCAPTCHA using only natural-language instructions to a commodity AI assistant.Source: §7 · p. 19

Related papers

Loading 2609.18518v1…