Robot vision beats Google reCAPTCHA with free AI at no cost
Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot
Cryptography and Security
Summary
Google reCAPTCHA uses pictures to stop bots from misusing websites, but new AI technology is making it easier to bypass these tests. The study shows that open-source, free AI models running on local computers can solve reCAPTCHA challenges without needing extra training or paid services. The researchers tested their approach and got over 90% success in beating real-world reCAPTCHA sessions. They also found that even people without technical skills can use AI assistants with simple instructions to break reCAPTCHA, suggesting that this security method is becoming less effective.
What this means in practice
- •For security teams: Evaluate and improve website bot defenses by testing against free, local AI models that can solve reCAPTCHA challenges automatically.
- •For web developers: Design user verification systems knowing that current visual CAPTCHA methods may be bypassed by low-cost AI solutions without extra training.
Authors
Suphannee Sivakorn, Samantha Gottlieb
Abstract
Google reCAPTCHA is the most widely deployed visual CAPTCHA service, protecting hundreds of thousands of websites from automated bots. It serves as a critical line of defense against automated attacks, including credential stuffing, bulk account creation, and automated form abuse. It has proven largely effective since its introduction in 2007. However, the rise of accessible AI now threatens its efficacy. Prior work has demonstrated that commercial cloud-based vision-language models (VLMs) can solve visual CAPTCHA challenges, but at non-trivial monetary cost per attempt. In this paper, we show that free and locally-run models can break Google reCAPTCHA. We conduct a comprehensive study of reCAPTCHA and present a taxonomy of its challenge types: Type A (independent image tiles, with static and dynamic sub-variants) and Type B (a single image partitioned into a 4x4 grid), each demanding a distinct solving strategy. We design zero-shot, no-cost solvers built entirely on open-source local models, specifically CLIP (58% per-challenge accuracy on Type A) and OWLv2 (43.5% on Type B), requiring no model training and no API access. Our end-to-end automated solver achieves a 92.6% per-session success rate across 500 real-world reCAPTCHA sessions. We further demonstrate that reCAPTCHA can be defeated by a non-technical adversary, using only natural-language instructions to a commodity AI assistant. This collapses the practical attacker skill floor to near zero and fundamentally changes the threat model for challenge-based CAPTCHAs. Although reCAPTCHA increasingly favors reputation-based verification, visual challenge-based fallback persists as a safety net that, paradoxically, has become the weakest link in the defense chain, suggesting that challenge-based visual CAPTCHAs may have reached the end of their useful life.