# Can AI solve CAPTCHA? Yes. Here is why we still refuse to > Models and solver services beat most CAPTCHAs today. Why your agent should still let a person pass every CAPTCHA and MFA prompt, with the case law. Source: https://cotlet.dev/blog/captcha-mfa-ai-agents Published: 2026-10-09 Models and solver services beat most CAPTCHAs today. Why your agent should still let a person pass every CAPTCHA and MFA prompt, with the case law. Cotlet team Connect account Password never stored Session saved Yes, AI can solve CAPTCHA. Researchers have beaten Google’s reCAPTCHA v2 image grids in every attempt, agents have been talked into solving puzzles, and paid services clear them for about a euro per thousand. Whether your agent _should_ is a different question, and the answer involves copyright law, computer-misuse law and plain trust. This post covers both, plus what an honest agent does instead, for CAPTCHAs and for MFA. ## Can AI solve CAPTCHA today? Short answer: most of the classic puzzles, yes. The evidence, as of October 2026: | What | Result | Source | | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | ETH Zurich, “Breaking reCAPTCHAv2” (2024) | YOLO image models solved 100% of reCAPTCHA v2 challenges, up from 68 to 71% in earlier work. Humans and bots needed about the same number of tries. | [arXiv 2409.08831](https://arxiv.org/abs/2409.08831) | | ChatGPT agent (2025) | After researchers primed it to believe the CAPTCHAs were fake, it solved one-click, logic and text CAPTCHAs, and some drag-and-drop and rotation puzzles. | [Malwarebytes, 22 Sept 2025](https://www.malwarebytes.com/blog/news/2025/09/chatgpt-solves-captchas-if-you-tell-it-theyre-fake) | | 2Captcha, a solver service | “Most captchas tasks are solved automatically by AI models”, with human workers for low-confidence cases. reCAPTCHA v2 costs €0.99 to €2.80 per 1,000. | [2captcha.com](https://2captcha.com/), checked October 2026 | | Browserbase, a browser platform for agents | “Browserbase enables CAPTCHA solving by default for all sessions.” | [Browserbase docs](https://docs.browserbase.com/platform/identity/captcha-solving) | Two things the top answers to this question usually skip. **The puzzle is no longer the main test.** reCAPTCHA v3 shows no challenge at all; it returns a score from 0.0 to 1.0 and “will never interrupt your users” ([Google](https://developers.google.com/recaptcha/docs/v3)). Cloudflare Turnstile runs “a series of small non-interactive JavaScript challenges” in the background ([Cloudflare](https://developers.cloudflare.com/turnstile/)). The ETH team also found that reCAPTCHA v2 leans heavily on cookies and browser history. So the real question is often not “can a model read the picture” but “does this browser look like a person”. Getting past that means faking a person: spoofed fingerprints, rotating residential IPs, synthetic mouse movement. **Most consumer assistants are told not to.** Malwarebytes notes that “most of the openly accessible AI chat agents have been barred from solving CAPTCHAs by their developers.” The ChatGPT result above needed a prompt injection to get around that rule. When the model’s own vendor treats it as a jailbreak, take the hint. ## Why do agent platforms ship solvers anyway? Because agents fail without them, and failing agents churn. If your workflow hits a challenge at step four, a solver keeps it running. _Browserbase documentation, CAPTCHA Solving page, October 2026._ Read the last paragraph of that page: “Use CAPTCHA solving only for workflows that users and website owners authorize.” That is the honest version of the rule, and it is a high bar. The website owner put the CAPTCHA there precisely to say no to automation at that point. A solver that is on by default leaves it to every customer to check that bar, workflow by workflow. Browserbase also documents how to turn it off (`solveCaptchas: false`), which is how Cotlet is designed to run. ## Is it legal to bypass a CAPTCHA? This is not legal advice. But the cases point in one direction. (For scraping law in general, see [is web scraping legal](https://cotlet.dev/blog/is-web-scraping-legal); here we stay on CAPTCHAs and logins.) ### DMCA section 1201: a CAPTCHA can be an access control - **Ticketmaster v. RMG Technologies** (C.D. Cal., October 2007). RMG sold software that let ticket brokers get past Ticketmaster’s CAPTCHA. The court granted a preliminary injunction and held that CAPTCHA “is a technological measure that regulates access to a copyrighted work”, because a user cannot reach the purchase pages without solving it ([order, CV 07-2534](https://www.cacd.uscourts.gov/sites/default/files/CV07-2534ABD.pdf)). Section 1201 has no minimum-loss threshold like the computer-fraud statute; circumventing the measure, or selling the tool, is the violation. - **Ticketmaster v. Prestige Entertainment** (C.D. Cal., 31 January 2018). Brokers allegedly used bots, “CAPTCHA farm” workers and automated solving. The court let the DMCA claim proceed: “CAPTCHA was a technological measure under the DMCA” ([Proskauer summary](https://newmedialaw.proskauer.com/2018/02/09/cfaa-unauthorized-access-web-scraping-claim-against-ticket-broker-dismissed-because-revocation-of-access-not-expressed-in-cease-and-desist-letter/)). - **Google v. SerpApi** (N.D. Cal., July 2026). The limit of the theory. Judge Yvonne Gonzalez Rogers agreed that spoofing fingerprints, rotating IPs and solving CAPTCHAs to get past Google’s SearchGuard _is_ circumvention, but dismissed the claims about ordinary search results because the wall was not guarding copyrighted works ([Search Engine Roundtable](https://seroundtable.com/google-lawsuit-serpapi-dismissed-41731.html)). Claims about licensed content got leave to amend. Read together: solving a CAPTCHA is circumvention. Whether that is illegal under the DMCA depends on what sits behind it. Behind a login, what sits there is usually someone’s account full of content, which is not a fight you want to have on a customer’s behalf. ### Computer-misuse law: consent can be withdrawn - **Facebook v. Power Ventures** (9th Cir., July 2016, amended December 2016). Power’s users had clicked a consent button to let Power use their Facebook accounts. The court said that consent was like “allowing a friend to use a computer”. But once Facebook sent a cease-and-desist and blocked Power’s IP, continued access broke the CFAA ([opinion](https://cdn.ca9.uscourts.gov/datastore/opinions/2016/12/09/13-17102.pdf)). The user’s permission does not outrank the platform’s explicit no. - Outside the US, wording matters too. Poland’s Criminal Code, art. 267 §1, punishes gaining access to information by “breaking or circumventing” (_przełamując albo omijając_) a security measure, with up to two years in prison ([text](https://e-prawnik.pl/porady-prawne/bezprawne-uzyskanie-dostepu-do-informacji-nieprzeznaczonych-dla-danej-osoby.html)). A CAPTCHA is a textbook security measure. Using a session the user created themselves, with their consent, does not circumvent anything. ## What about MFA? The “ai agent 2fa” question MFA is a sharper line than CAPTCHA. A CAPTCHA asks “are you a person”. MFA asks “are you _this_ person”. An agent that can pass MFA on its own has, by definition, a second factor it should not have. The bad patterns look like this: - The agent asks you to paste the six-digit code into the chat. Now the code sits in the model’s context, in logs, and in any tool output a prompt injection can read. - A service stores your TOTP seed next to your password, so “two factors” live in one vault. - An integration reads your SMS or email to grab the code without you seeing the prompt. The MCP spec draws the same line. Since the 2025-11-25 revision, a server that needs a secret must send you to a URL instead of asking through the chat. _Model Context Protocol specification, Elicitation page (version 2026-07-28), October 2026._ URL mode exists so that “sensitive credentials never pass through the LLM context, MCP client or any intermediate MCP servers” ([MCP spec](https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation)). Clients must show you the full URL and get your consent before opening it. That is the right “mcp 2fa” pattern: the server sends you to a page, you finish the check in a real browser, and the agent never touches the code. If your team needs integrations to re-authenticate on their own, the clean answer is a dedicated service account that your admin creates, with its own MFA, not a person’s second factor handed to a bot. (For the wider set of controls around agents and accounts, see [AI agent account security](https://cotlet.dev/blog/ai-agent-account-security).) ## Signed agents: the honest alternative to solving The industry is building a way for agents to say what they are instead of pretending to be people. - **Cloudflare signed agents** (28 August 2025): a bot class for agents “directed by an end user rather than a single company”, whose requests are signed with Web Bot Auth. Launch partners included ChatGPT agent, Block’s Goose, Browserbase and Anchor Browser ([Cloudflare blog](https://blog.cloudflare.com/signed-agents/)). - **IETF webbotauth working group**: chartered to standardize how automated clients cryptographically authenticate to websites and tell sites who operates them ([IETF datatracker](https://datatracker.ietf.org/wg/webbotauth/about/)). A signed agent can be blocked with one rule, which is the point. The site owner gets to decide. A solver takes that decision away from them. ## A decision rule for your own agent Whatever tools you use, this table holds up: | Your agent hits… | Do this | Not this | | ---------------------------------- | ----------------------------------------------------------------------- | ---------------------------------------- | | A visible CAPTCHA | Stop, return a link, let the person finish it | Call a solver or a CAPTCHA farm | | An invisible score that blocks you | Slow down, use the person’s own stable session, or use the official API | Rotate IPs, spoof fingerprints | | An MFA prompt | Send the person to a URL where they enter it themselves | Ask for the code in chat, store the seed | | An expired session | Ask the person to sign in again | Replay a stored password | | A cease-and-desist or a block | Stop for everyone, now | Keep going with user consent | And three checks before you build anything: 1. **Is there an official API or MCP server?** Use it. OAuth beats every trick in this post. Zapier, Make or doing the task by hand are also better than a solver. 2. **Who owns the account?** Act only on accounts the person controls and has agreed to automate, action by action. 3. **Would you show this step to the site owner?** If the honest description is “we make our bot look human”, redesign the step. ## How Cotlet handles CAPTCHA and MFA Cotlet hosts unofficial integrations, as an MCP server for agents and a REST API for scripts, for apps that have no API or a narrow one: booking tools like [Booksy](https://cotlet.dev/integrations/booksy-api-mcp-server), creator platforms like [Patreon](https://cotlet.dev/integrations/patreon-api-mcp-server). Here is how it is designed to treat the challenges above: - **You pass the first sign-in yourself.** The connect page shows a browser running on our side. You type your login, enter your 2FA code and solve a CAPTCHA if the app shows one. Your password goes to the app, never to our database. The [connect flow](https://cotlet.dev/blog/connect-without-your-password) has the details. - **We keep the session, not the password.** Cookies and tokens go into an encrypted vault, with one stable browser context and IP per connected account, at a human pace. That is what makes challenges rare after the first sign-in: apps mostly show them when a login looks suspicious. - **When a check comes back, you handle it.** A tool call returns `AUTH_EXPIRED`, `CAPTCHA_REQUIRED` or `MFA_REQUIRED` with a link to the connect page. Your agent asks you to finish there. We never log in for you, and we cannot: we do not have your password. The [help page](https://cotlet.dev/help) lists every code. - **Solvers stay off.** Hosted browsers often ship with CAPTCHA solving on; Cotlet is designed to run with it switched off. _Cotlet security page, “What we never do” section, October 2026._ The cost is real: now and then you will open a link and sign in again. We think that is the right trade. A vendor that defeats one security control on your behalf will defeat the next one, and the apps you depend on can tell the difference. The full list of what we will not automate is in the [acceptable-use policy](https://cotlet.dev/acceptable-use), and the vault is described on the [security page](https://cotlet.dev/security). If you want your agent working in apps that never gave it a door, [request access](https://cotlet.dev/signup) and pick your apps. [All posts](https://cotlet.dev/blog) ## Want your app first? Pick it when you sign up. The most-picked apps open first. [Request access](https://cotlet.dev/signup)