Type What You Hear: A History and Evolution of CAPTCHA Bypass

The CAPTCHA is twenty years old, and for twenty years people have been defeating it — first with shape-matching algorithms, then with sweatshops, then with deep networks, and now with off-the-shelf speech models. This article traces the full arms race from the 1997 AltaVista patent to 2026’s LLM-agent research, and walks through a working PoC that solves reCAPTCHA v2’s audio challenge end-to-end with Playwright and a local Whisper model — including why the same script dies on a flagged IP before the puzzle is ever shown.

Introduction

In our article on the evolution of web scraping we covered the escalation from LWP::Simple one-liners to headless-browser fleets, and in our Camoufox deep dive we covered the fingerprint-coherence problem that decides whether an automated browser survives first contact with a WAF. This article covers the third pillar of the anti-bot stack: the challenge itself. The CAPTCHA — and specifically the decades-long effort to defeat it.

The history is worth telling properly, because two decades of attack research produced a counterintuitive result: the puzzle stopped mattering. Modern text, image, and audio challenges are all solvable by machines — some with accuracy that would have sounded absurd in 2007 — yet CAPTCHA-protected sites have not collapsed. What actually decides whether an automated session gets through is everything around the puzzle: the risk engine’s verdict on the browser environment, the cookie history, and the reputation of the IP address. The puzzle is now just the friction applied when the environment already looks guilty.

We will build to that conclusion with the evidence. Along the way we’ll test two eras of bypass ourselves: an OCR solver against distorted text, and a fully working reCAPTCHA v2 audio solver using Playwright and a locally-run Whisper model — tested against Google’s official demo page, with real output, including the runs where Google’s risk engine refused to serve us any challenge at all. Those failures are the most instructive part.

Attention! Scope and ethics. Everything in this article targets Google’s official, public reCAPTCHA demo endpoint — the page Google publishes for testing the widget — and locally generated test CAPTCHAs. Solving CAPTCHAs on systems you do not own or operate is abuse of those systems, is against the terms of every CAPTCHA vendor, and in many jurisdictions is computer misuse. The techniques are documented because they are already public in peer-reviewed research and vendor blog posts — knowing how attacks work is a prerequisite for defending against them.

What a CAPTCHA Is, and the Bargain It Makes

A CAPTCHA — Completely Automated Public Turing test to tell Computers and Humans Apart — is a reverse Turing test: administered by a machine, passed by a human. The term and the concept were formalized by Luis von Ahn, Manuel Blum, Nicholas Hopper, and John Langford at Carnegie Mellon in their 2003 Eurocrypt paper, which proposed using “hard AI problems” as security primitives. The idea contains a deliberate bargain: either bots cannot pass the test (and the scheme works), or bots can pass it — in which case the attacker has accidentally solved a hard AI problem, and humanity is net ahead.

That bargain explains the entire subsequent history. Every CAPTCHA generation is built on a task that AI is momentarily bad at; every few years, AI catches up; the scheme must then evolve or die. The academic literature broke each generation roughly on that schedule.

The generations, compressed:

A Twenty-Year Arms Race

1996–2003: Origins

The idea pre-dates the name. Moni Naor sketched the concept in a 1996 essay, and in 1997 — working in parallel, as it happens — Mark Lillibridge, Krishna Bharat, and Martin Burges at DEC built a distorted-text filter for AltaVista’s search-submission form, patented as US 6,195,698 (granted 2001). The patent describes the entire scheme in period language: a “riddle” formed by randomly modifying a character string “either visually or audibly” — text and audio CAPTCHAs in a single filing, four years before the field had a name. PayPal deployed distorted-text tests as anti-fraud in 2001. When von Ahn’s group published CAPTCHA: Using Hard AI Problems for Security (Eurocrypt 2003, LNCS 2656), they gave the field its name, its security definition, and its taxonomy: text-based (Gimpy), image-based (ESP pix), and audio-based for visually-impaired users.

2003–2007: First blood — algorithms

The first famous break came almost immediately. Greg Mori and Jitendra Malik at UC Berkeley attacked EZ-Gimpy — the Yahoo registration CAPTCHA — using shape context matching, a general-purpose object recognition technique, and passed it 92% of the time. Their CVPR 2003 paper, Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA, made a point that would echo for twenty years: they did not exploit any implementation bug; they simply solved the underlying vision problem better than the designers assumed was possible.

2007–2014: Industrialization — farms, then machine learning

reCAPTCHA launched from CMU in May 2007 with a genuinely elegant idea: every solved CAPTCHA digitizes a word from a book. Google acquired it in September 2009 and fed it the New York Times archive and Street View house numbers; by 2010 the system was serving over 100 million challenges a day. At that scale, an economic fact became permanent: a CAPTCHA does not need to be unbreakable, only uneconomic to break — and human labor is cheap.

Human CAPTCHA farms industrialized in this window, and they never went away. They are API businesses today — current published pricing from 2Captcha: £0.45–£0.89 per 1,000 image CAPTCHAs, £0.80–£2.45 per 1,000 reCAPTCHA v2, £1.20 per 1,000 Cloudflare Turnstile, with humans-or-models in the loop and sub-minute solve times. Against a target where a successful signup is worth pennies, that is not a barrier; it is a line item.

Machine learning ended the pure-text era in stages:

• 2011, image schemes wobbled too. Philippe Golle’s CCS 2011 attack on Microsoft’s Asirra CAPTCHA — pick the cats among the dogs, a task chosen precisely because computers were bad at it — classified images at 74.6% accuracy with an SVM trained on just 4,000 examples. Asirra shut down in 2014.
• 2011–2014, generic solvers. Elie Bursztein’s group (Stanford, later Google) demonstrated that a single learning-based attack could be retargeted across schemes without hand-crafted segmentation. Their WoOT 2014 paper The End is Nigh: Generic Solving of Text-based CAPTCHAs solved every real-world text scheme they evaluated “accurately enough to consider the scheme insecure in practice” — including Yahoo at 5.33% and reCAPTCHA at 33.34% — using one unmodified algorithm.
• 2013, deep CNNs read house numbers. Goodfellow et al.’s Multi-digit Number Recognition from Street View Imagery using Deep Convolutional Neural Networks (arXiv 1312.6082) trained an 11-layer network that read complete street numbers at over 96% accuracy — precisely the distortion-and-clutter workload CAPTCHAs were supposed to represent.
• 2018, the formal death certificate. Ye et al.’s CCS 2018 GAN-based solver (Yet Another Text Captcha Solver) defeated all 11 text CAPTCHAs in use among the top-50 websites of the time, training on as few as ~500 samples per scheme.

Google’s response was already deployed by then: on December 3, 2014 the NoCAPTCHA reCAPTCHA replaced typing with a single checkbox — “I’m not a robot” — backed by behavioral risk analysis, escalating to 3×3 image grids when the score was bad. reCAPTCHA v1 was shut down on March 31, 2018.

2017–2022: The behavioral era — and the audio back door

The checkbox era moved the battleground from perception to behavior, but it kept an accessibility escape hatch: the audio challenge. That hatch turned out to be the soft underbelly.

• 2017, unCaptcha. Kevin Bock and colleagues at the University of Maryland defeated reCAPTCHA’s audio challenge — spoken digits against background noise — with 85% accuracy using free, off-the-shelf speech-to-text services.
• 2019, unCaptcha2. After Google’s countermeasures, the same team returned with a simpler pipeline (a single free speech API) achieving around 90% accuracy, and documented responsible disclosure with Google’s reCAPTCHA team dating to June 2018.
• 2019, attacking the score itself. Saueressig et al. showed reCAPTCHA v3’s invisible score could be gamed directly with reinforcement learning — an RL agent trained to move the mouse and click the reCAPTCHA button achieved a 97.4% success rate on a 100×100 grid (arXiv 1903.01003).

The defenses were simultaneously losing their innocence. Cloudflare — which in May 2021 estimated that humanity was wasting roughly 500 human years per day on CAPTCHAs, averaging 32 seconds per challenge — had already dropped Google’s reCAPTCHA in April 2020, citing customer privacy concerns about feeding more behavioral data to an advertising company, plus intermittent blocking of Google services in China. They moved to hCaptcha (Intuition Machines), and in September 2022 shipped Turnstile, a CAPTCHA-free, privacy-preserving challenge built on proof-of-work, private access tokens, and browser attestation. The industry’s honest admission was now on the record: the puzzle itself had failed as a human test.

2023–2026: The LLM era

Three results from the last two years define the current state of play:

1. The image grids are fully solved. Breaking reCAPTCHAv2 (COMPSAC 2024; ETH Zürich) fine-tuned YOLOv8 to solve 100% of reCAPTCHA v2 image challenges in their test runs — prior published work managed 68–71%. The same paper’s more important finding: there was no significant difference in the number of challenges served to humans versus bots, and the session’s verdict is “heavily based on cookie and browser history data.” Their bot only survived when using realistic mouse movements and a VPN.
2. LLM agents break the “no AI would solve a CAPTCHA” assumption. In September 2025, SplxAI (since acquired by Zscaler) showed that a prompt-injected ChatGPT Agent — told the puzzles were fake — would solve image CAPTCHAs and even adjust its cursor behavior to mimic a human. The “we’ll just instruct the AI not to” defense failed on contact.
3. Measurement agrees: challenge-based defenses are broadly ineffective. Broken Gates (arXiv 2607.18659, July 2026) tested seven commercial solving services and six LLM browser agents against hCaptcha, reCAPTCHA v2, reCAPTCHA v3, and Cloudflare Turnstile. The commercial solvers achieved “near-perfect bypass at negligible cost” against the challenge-based defenses. The one system that meaningfully resisted — reCAPTCHA v3’s invisible scoring — did so for a revealing reason: the deciding factor was execution-environment authenticity, not the agent’s behavior. Two agents with nearly indistinguishable behavior got opposite verdicts; the difference was the browser environment underneath them. A companion benchmark, HLL: Can Agents Cross Humanity’s Last Line of Verification? (arXiv 2606.02449, June 2026), found frontier multimodal agents still “brittle” on interactive CAPTCHA flows — but agent capability curves do not bend downward.

That last point is the thesis of this article, and we’ll now demonstrate both halves of it ourselves: the puzzle is trivially solvable (with a speech model), and the environment is what actually decides whether you even get to see it.

The Taxonomy of Bypass

The PoC: Two Eras of Bypass, Tested

https://github.com/Hunt-Benito/type-what-you-hear-a-history-of-captcha-bypass

The companion repo contains two solvers, one per era:

• solver_ocr.py — the classic approach: generate distorted-text CAPTCHAs locally with the captcha package, break them with a modern descendant of the 2011–2018 OCR solvers (the ONNX-based ddddocr engine, which runs offline with no system dependencies).
• solver_audio.py — the modern approach: drive a real browser with Playwright, click through reCAPTCHA v2’s checkbox, switch to the audio challenge, download the audio, transcribe it with faster-whisper (Whisper base.en, int8, CPU-only, fully local), submit the transcript, and harvest the g-recaptcha-response token.

Era 1: OCR against distorted text

$ python3 -m venv venv && source venv/bin/activate
$ pip install ddddocr captcha
$ python solver_ocr.py --count 30

[*] generating 30 text captchas (5 chars, lowercase)
[*] samples (truth -> prediction):
    glhze -> 8vhze
    ihopq -> ih0p9
    eirwg -> eirw
    bgjzr -> bgzr
    rricw -> rricw
[*] accuracy: 8/30 = 27%

A 27% per-attempt success rate is a failing grade for a login form and an assembly line for an attacker — the expected number of retries per success is under four, at zero marginal cost, running offline. This is the economics that made even the 5.33% result against Yahoo in 2014 “insecure in practice”: the attacker does not need your scheme to be weak, only weaker than the value of one successful submission.

Era 2: The reCAPTCHA v2 audio challenge, end to end

The audio solver implements the full pipeline:

checkbox click (humanized mouse)
   -> challenge iframe
   -> switch to audio (headphones button)
   -> download mp3
   -> faster-whisper base.en (local, CPU)
   -> submit transcript -> g-recaptcha-response token

One detail matters before the run: current reCAPTCHA audio challenges are no longer digit strings. They speak phrases — frequently fake “1-800-” phone numbers — buried in noise. The unCaptcha-era approach of extracting digits is dead; the working approach is to submit the cleaned transcript.

Attention! The environment experiment. We ran identical solver logic from three environments, and the risk engine’s decision happened before any puzzle was shown:

The winning configuration, through a carrier-grade mobile exit:

$ python solver_audio.py --engine firefox --proxy "http://127.0.0.1:18080"
[*] loading whisper base.en (int8, cpu) ...
[*] navigating to https://www.google.com/recaptcha/api2/demo
[*] checkbox clicked, waiting for decision ...
[*] image challenge served -- switching to audio
[*] attempt 1: downloaded audio (36373 bytes)
[*] transcription: 'The case is communicating with...' -> answer: 'the case is communicating with'
[*] SUCCESS on attempt 1: token = 0cAFcWeA53LC5ck9w9AB_tzFFy9ongyLQrLmN9gr...
[*] result: SOLVED in 27.8s

Three consecutive runs, three tokens, ~28–33 seconds each on a CPU-only machine with a 145 MB speech model. Two of the three accepted transcripts were truncated phrases, which suggests fuzzy grading — but a token is a token. For the record, the same script through a flagged session dies politely:

[*] risk engine served the 'automated queries' dead end:
    "Your computer or network may be sending automated queries.
     To protect our users, we can't process your request right now"
[*] hint: this session's IP/environment was flagged; retry with a cleaner IP

Caveat. This is a measurement, not a universal claim. The risk engine’s verdict depends on IP reputation, browser fingerprint, and behavioral history — all of which change daily. The point of the table is the pattern, which matches the published literature exactly: the ETH group needed realistic mouse movements and a VPN for their 100% solver; Broken Gates isolated environment authenticity as the determining factor. The puzzle has never been the problem; the interview before the puzzle is.

Why the Puzzle Stopped Mattering

Strip away the product names and a modern “CAPTCHA” is a risk engine that scores a session and only shows a puzzle when the score is bad:

The evidence for what feeds that score comes from multiple directions: the ETH group’s finding that verdicts hinge on cookie and browser history; the long-standing observation that reCAPTCHA grades anonymous and VPN users more harshly than logged-in Google users; Broken Gates’ trace analysis pinning the outcome on the execution environment; and our own three-way experiment above, where the deciding difference was the browser build plus IP class.

For the attacker, this converts a perception problem into an environment problem, and the scraping ecosystem solved the environment problem years ago — that is the entire anti-detect-browser industry we covered in the Camoufox article: coherent fingerprints, warm profiles, humanized input. One leg of that stack deserves specific attention here because it decided our own experiment: IP class. Datacenter ranges are pre-condemned; residential proxies are better but increasingly contested; mobile-carrier exits — pools of real 4G/5G subscriber IPs behind carrier-grade NAT — consistently receive the gentlest treatment, because from the network’s point of view a script behind one looks like a phone on a cell network, and blocking those IPs means blocking real customers. In our runs, every configuration that earned a solvable challenge egressed through our own mobile-carrier proxy service — no session we attempted without it ever got past the risk gate. The same honesty cuts both ways: any proxy helps with IP reputation; the mobile kind specifically matters when the target’s risk model differentiates by ASN class, as Google’s visibly does.

The uncomfortable summary for defenders: against a competent adversary, a challenge-based CAPTCHA in 2026 is a speed bump priced in pennies per thousand. What still works is everything around it — and even Broken Gates frames the surviving security boundary as lying “at the environment layer.”

What Defenders Should Actually Take From This

1. Never let a CAPTCHA be the only control on a valuable action. Rate-limit the action (signup, checkout, API key issuance), not the challenge. Solvers are commodity-priced; an action-level abuse budget makes each solve worth less than it costs.
2. Score the environment, and prefer non-interactive defenses. The measurement literature — and our runs — agree that passive signals (execution environment, token freshness, attestation) separate bots from humans far better than puzzles. reCAPTCHA v3’s invisible scoring, Cloudflare Turnstile, and proof-of-work schemes all operate here.
3. Assume the audio path is attacked first. It exists for accessibility — keep it — but instrument it: request velocity on the audio endpoint, transcription-shape answers, and identical-environment repeats are all loud signals. The modern challenges (phrase audio, noisy grids) raise solver cost; they do not change the economics at £1.20 per thousand.
4. Treat “we’ll ask the AI nicely not to solve CAPTCHAs” as already falsified. Prompt-injection research (SplxAI, 2025) showed model-level policies fail the moment an attacker frames the challenge as fake. Agent-era defenses must be environmental, not instructive.
5. For humans’ sake, minimize challenges entirely. The 32-second average solve time and 500-human-years-per-day estimate were scandalous in 2021 and are unjustifiable now that puzzles stop no serious attacker.

Conclusion

Twenty-three years ago, von Ahn’s group proposed a security primitive with a built-in consolation prize: if you defeat it, you’ve solved a hard AI problem. The history we’ve traced — 92% on EZ-Gimpy in 2003, £1-per-thousand human farms, 100%-accuracy YOLO solvers in 2024, and a Whisper model casually earning reCAPTCHA tokens on a laptop CPU in our own test — is the AI-research community collecting that prize, over and over, on schedule.

The industry’s response has been to move the goalposts somewhere better: from “can you solve this puzzle” to “does your entire session — browser, history, network, behavior — look like a real person’s.” That question is genuinely harder to fake, and it’s the same fingerprint-coherence problem we dissected with Camoufox, extended to the network layer. But it is an environment question, not a perception question, and environments can be bought, warmed, and spoofed by anyone patient enough. The arms race isn’t over; it just isn’t about puzzles anymore.

SOURCES

Von Ahn et al., CAPTCHA: Using Hard AI Problems for Security (Eurocrypt 2003): https://doi.org/10.1007/3-540-39200-9_18
Moni Naor, Verification of a Human in the Loop, or Identification via the Turing Test (1996): http://www.wisdom.weizmann.ac.il/~naor/PAPERS/human.pdf
US Patent 6,195,698 B1 — Lillibridge, Bharat & Burges (DEC/AltaVista, filed 1997): https://patents.google.com/patent/US6195698B1/en
Greg Mori and Jitendra Malik, Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA (CVPR 2003) — project page and results: https://www.cs.sfu.ca/~mori/research/gimpy/
Elie Bursztein et al., The End is Nigh: Generic Solving of Text-based CAPTCHAs (WoOT 2014): https://www.elie.net/publication/the-end-is-nigh-generic-solving-of-text-based-captchas
Goodfellow et al., Multi-digit Number Recognition from Street View Imagery using Deep CNNs (arXiv 1312.6082): https://arxiv.org/abs/1312.6082
Ye et al., Yet Another Text Captcha Solver (CCS 2018): https://dl.acm.org/doi/10.1145/3243734.3243754
Philippe Golle, Machine Learning Attacks Against the Asirra CAPTCHA (CCS 2011): https://dl.acm.org/doi/10.1145/2046707.2046724
Google Security Blog, Are you a robot? Introducing “No CAPTCHA reCAPTCHA” (Dec 2014): https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html
Wikipedia, reCAPTCHA (history, v1 shutdown, v2/v3 timeline): https://en.wikipedia.org/wiki/ReCAPTCHA
Google blog, Teaching Computers to Read (reCAPTCHA acquisition, Sept 2009): https://googleblog.blogspot.com/2009/09/teaching-computers-to-read-google.html
Bock et al., unCaptcha: defeating audio reCAPTCHA with 85% accuracy (UMD, 2017): https://github.com/ecthros/uncaptcha
Bock et al., unCaptcha2 (2019): https://github.com/ecthros/uncaptcha2
Saueressig et al., Hacking Google reCAPTCHA v3 using Reinforcement Learning (arXiv 1903.01003): https://arxiv.org/abs/1903.01003
Aase, Plesner et al., Breaking reCAPTCHAv2 (COMPSAC 2024, arXiv 2409.08831): https://arxiv.org/abs/2409.08831
Breaking reCAPTCHAv2 — companion code: https://github.com/aplesner/Breaking-reCAPTCHAv2
Saueressig et al., Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2 (arXiv 2311.10911): https://arxiv.org/abs/2311.10911
SplxAI (Zscaler), ChatGPT Agent Violates Policy and Solves Image CAPTCHAs (Sept 2025): https://splx.ai/blog/chatgpt-agent-solves-captcha
HLL: Can Agents Cross Humanity’s Last Line of Verification? (arXiv 2606.02449): https://arxiv.org/abs/2606.02449
Broken Gates: Re-evaluating Web Bot Defenses in the Age of LLM Agents (arXiv 2607.18659): https://arxiv.org/abs/2607.18659
Cloudflare, Moving from reCAPTCHA to hCaptcha (April 2020): https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/
Cloudflare, Humanity wastes about 500 years per day on CAPTCHAs (Introducing Cryptographic Attestation of Personhood, May 2021): https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/
Cloudflare, Turnstile: a user-friendly, privacy-preserving alternative to CAPTCHA (Sept 2022): https://blog.cloudflare.com/turnstile-private-captcha-alternative/
Google reCAPTCHA official demo page: https://www.google.com/recaptcha/api2/demo
2Captcha published pricing: https://2captcha.com/pricing
Wikipedia, CAPTCHA (history and attack overview): https://en.wikipedia.org/wiki/CAPTCHA