What’s going on with captchas, those demands from websites to prove you are human? Here is a look at how they are evolving in the wake of AI.

CAPTCHAs, which stand for "Completely Automated Public Turing test to tell Computers and Humans Apart," are designed to differentiate human users from automated bots. These tests are becoming increasingly challenging due to the rapid advancements in artificial intelligence. Historically, CAPTCHAs relied on tasks theoretically easy for humans but hard for computers, such as recognizing distorted text or identifying objects in images. However, AI models, even as early as 2016, could solve reCAPTCHA v2 with 70% accuracy using low-cost deep learning. By 2024, an AI model was able to solve these puzzles with 100% accuracy, and in 2026, a tool was developed to mimic human browsing behavior to bypass or solve reCAPTCHAs.

This arms race between humans and machines has forced CAPTCHA developers to evolve. Traditional image-based puzzles, like selecting traffic lights or buses, are now considered outdated because bots have become adept at solving them. Ashish Jain, CTO of Arkose Labs, a firm behind CAPTCHAs for platforms like LinkedIn and HBO, noted that "Bots have evolved, but legacy captchas haven’t." The data generated from human attempts to solve these puzzles is ironically used to train AI systems, which then become better at defeating them.

Modern CAPTCHAs are moving towards "invisible" challenges, which operate in the background without requiring user interaction. Systems like Google's reCAPTCHA v3, Friendly CAPTCHA, hCAPTCHA, and Cloudflare's Turnstile analyze various background clues. These include monitoring whether an action originates from an attested device, checking for high volumes of automated requests from an IP address, analyzing user navigation patterns, and examining cookie history. Google's reCaptcha v3, launched in 2018, significantly reduced the frequency of visible challenges by analyzing user behavior and signals to generate a risk score, making the bot-blocking technology "completely invisible" for most users.

Companies like Google and Cloudflare also leverage these systems for data collection. Cloudflare, for example, offers Turnstile for free, partly because it helps them gather a massive dataset on human versus bot behavior across 20% of all HTTP requests on the internet. While traditional visual challenges are expected to persist, their importance is diminishing. Future CAPTCHAs may introduce new challenge types, such as scanning QR codes or performing specific hand gestures, to add friction without overly confusing users. Mauro Migliardi, a professor of software engineering, suggests that physical challenges, like rotating phones, might become necessary as AI improves.

Privacy-focused alternatives are also emerging, such as Privacy Pass, developed by a coalition including Google, Fastly, Cloudflare, and Apple. This mechanism uses information from a user's device, like facial unlocks, to attest to their humanity without sharing personal data with websites. Apple has implemented this as Private Access Tokens (PATs) on iOS 16 and later, with over half of iOS device requests using PATs by July. While CAPTCHAs are not expected to disappear soon due to their cost-effectiveness and platform-agnostic nature, the trend is toward less frequent and more sophisticated, often invisible, verification methods.