Broken Gates: Re-evaluating Web Bot Defenses in the Age of LLM Agents Behzad Ousat, Nikita Turkmen, Lalchandra Rampersaud, Dillan Bailey, and Amin Kharraz {bousat, nturk005, lramp004, dbail042, mkharraz}@fiu.edu Florida International University
arXiv:2607.18659v1 [cs.CR] 21 Jul 2026
Abstract
abuse. Challenge-based Captchas and non-interactive botmanagement systems [3] have been central to this defense, reducing the impact of many common forms of scripted and high-volume automated traffic. These systems have also adapted over time by combining explicit challenges with behavioral analysis, browser execution signals, reputation information, and risk-based decision-making. This adaptation has sustained the competition between attackers and defenders, but the boundary these systems rely on is becoming less stable. Many deployed defenses assume that explicit challenges impose meaningful friction and that automated actors remain behaviorally distinguishable from legitimate users. Third-party solver services weaken the first assumption by allowing attackers to outsource Captcha challenges at low cost [16, 18]. Credential stuffing, account takeover, and large-scale abuse campaigns routinely use these services as an operational step, allowing high-volume automation to continue despite deployed anti-bot controls [9, 23, 32]. More recently, LLM-based browser agents challenge the second by operating through ordinary web interfaces: they can navigate websites, interpret page content, submit forms, adapt to feedback, and continue multi-step workflows from naturallanguage instructions. As a result, modern automation is no longer limited to brittle scripts that fail at hard interaction points; it can combine solver services, real-browser execution, feedback adaptation, and goal-directed task completion. In this paper, we first establish what commercial solver services can and cannot defeat across seven web bot management systems, identifying their effective ceiling for both challengebased and non-interactive systems (RQ1). We then evaluate six LLM-based browser agents spanning cloud-hosted, selfhosted, AI-assisted browser, and browser-extension deployment modes to characterize how off-the-shelf agents perform against the same configurations (RQ2). Finally, we investigate why default agents fail against non-interactive defenses (RQ3). The results reveal that solver services achieve near-perfect bypass against challenge-based Captchas at costs as low as $0.10 per 1,000 solves, making these defenses largely inef-
LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language instructions. This evolution raises fundamental questions about the effectiveness of bot management systems, widely deployed to defend against automated web abuse. In this paper, we present a systematic measurement study evaluating the resilience of both interactive challenge-based defenses and non-interactive trust-based defenses against two attacker classes: commercial Captcha-solving services and LLMbased browser agents. Our evaluation spans seven solver services and six agents, including cloud-hosted, self-hosted, AIassisted, and browser-extension configurations, tested against hCaptcha, reCaptcha v2, reCaptcha v3, and Cloudflare Turnstile. Our results show that challenge-based defenses are broadly ineffective against commercial solvers, which achieve nearperfect bypass at negligible cost. The challenges can similarly be defeated by LLM-based agents when a dedicated solver module is available. Non-interactive defenses such as reCaptcha v3 exhibit stronger resistance, but our analysis reveals that this resilience does not reflect a fundamental security property. Through fine-grained interaction trace analysis, we find that two agents with nearly indistinguishable behavioral footprints yield divergent outcomes, one bypassing the defense and one failing, isolating execution-environment authenticity, rather than agent behavior, as the determining factor. These findings suggest that the security boundary of non-interactive defenses lies at the environment layer, with significant implications for how bot management systems are designed and evaluated.
1
Introduction
Modern web defenses increasingly depend on mechanisms that distinguish legitimate human use from automated 1
fective against cost-driven adversaries. However, they reach only 23% success on average against reCaptcha v3. On the other hand, the evaluated LLM-based browser agents generally fail on the challenge-based defenses, unless in cases where a dedicated Captcha solver module is available [34]. The same agents mostly fail on non-interactive defenses too, not because they cannot complete the required interaction, but because their browser execution environments produce detectable artifacts that the system flags. We show that this failure is not a durable security property, but rather a consequence of environmental authenticity signals independent of agent behavior. Our interaction analysis reveals that behavioral similarity does not guarantee bypass: Browser-Use and NanoBrowser produce nearly indistinguishable event traces, yet only NanoBrowser, which operates within a real browser profile with persistent cookies, browsing history, and stable fingerprinting signals, consistently achieves bypass. This indicates that the trust gap originates not from agent behavior, but from the absence of long-term environmental legitimacy in clean, instrumented browser environments. In summary, this paper makes the following contributions: First, we present a systematic measurement study of seven commercial solver services against different configurations of hCaptcha, reCaptcha v2, reCaptcha v3, and Cloudflare Turnstile, covering seven overall settings with varying difficulty and interaction requirements. Our results show that challengebased defenses are almost universally defeated at negligible cost, while non-interactive defenses such as reCaptcha v3 exhibit meaningful resistance against solver services. Second, we evaluate six LLM-based browser agents against the same defense configurations, finding that agents consistently fail on challenge-based defenses without dedicated solver modules, and similarly fail on non-interactive defenses despite successfully completing the required interaction workflows. This establishes that the agent failure boundary is not task comprehension, but execution environment detectability. Third, we investigate the root cause of this failure through fine-grained interaction trace analysis, comparing BrowserUse and NanoBrowser, two agents with nearly indistinguishable behavioral footprints, and finding that environmental authenticity signals, rather than behavioral similarity, determine bypass success. This reveals that the resilience of noninteractive defenses is an artifact of execution environment properties rather than a fundamental security guarantee.
2
while malicious automation drives abuse, including spam, credential stuffing, click fraud, and large-scale vulnerability scanning [9, 15, 21, 23]. Li et al. [23] found that 57% of bots observed over seven months were plainly malicious, exploiting newly disclosed vulnerabilities within hours of public disclosure and evading detection via browser modification, spoofed User-Agent strings, and proxy routing. Recent incident reports on account takeover and credential stuffing campaigns reveal the scale and structure of this abuse. Akamai recorded 193 billion credential stuffing attempts in 2024, a 66% increase over the prior year [7]. Analysis of 22 active credential-stuffing groups found that 65% of attacks leveraged Captcha solver services and residential proxies, and that 85% of targeted organizations had bot detection in place yet were still successfully compromised [19]. Furthermore, Verizon’s 2025 DBIR corroborates this at the breach level: credential stuffing constituted 19% of all authentication attempts on a median daily basis in SSO provider logs, and stolen credentials were the initial access vector in 22% of confirmed breaches [40]. Understanding why these attacks persist requires examining the defenses they are designed to defeat. Bot management systems remain a primary countermeasure for distinguishing human users from automated clients at web interaction points. These defenses can be categorized into two main groups. Challenge-based systems rely on explicit user interaction; reCaptcha v2 and hCaptcha are two popular challengebased defenses that can render image recognition or puzzle tasks and are often tuned by operators to balance user friction with abuse resistance. Non-interactive defenses, on the other hand, reduce explicit challenges and rely more on background telemetry. These systems emphasize environmental integrity checks and behavioral scoring with site-specific thresholds. This shift changes the attack surface from “can the bot solve a puzzle” to “can the automation stack look sufficiently human and trustworthy.”
2.2
Automated Solvers and Solving Services
A substantial body of work demonstrates that the web bot management systems are vulnerable to automated solvers across all major challenge types. Text-based Captcha schemes have been broken using GANs, CNNs, and RNNs, with success rates exceeding 94% [14, 37, 45, 46]. Image-based reCaptcha challenges have similarly been defeated, with deep learningbased solvers achieving 70% accuracy by exploiting image repetition [33], and audio variants bypassed via off-the-shelf speech recognition [8]. Even reCaptcha v3’s behavioral scoring has been compromised using reinforcement learning: Tsingenopoulos et al. [39] trained an agent over months of score feedback to simulate human-like browsing, achieving evasion rates up to 99.6%. Across all these approaches, the common bottleneck is data dependency, requiring each solver to be trained or fine-tuned as providers update their challenge pools.
Background and Related Work
2.1 Automated Traffic and Contemporary Defenses Automated web traffic spans a wide spectrum of intent. Beneficial bots underpin critical infrastructure such as web crawlers, conversational agents, and monitoring systems [20, 22, 43], 2
Automated crawlers and solvers work together to bypass the defense; the crawler detects a Captcha challenge, delegates it to the solver, and resumes automated traversal upon receiving a solution or a valid token when required. In [30], the authors create a pipeline to integrate a pre-trained text-based Captcha solver into a real-world crawler and achieve 63% successful bypass in only five attempts for each target page. In practice, most malicious actors are cost-driven and will gravitate toward whichever bypass method minimizes overhead and cost. Commodity solver services meet this demand by abstracting the problem entirely via hybrid human/automation pipelines [16, 18, 28, 42], eliminating the need for any model expertise. The user simply submits a site key, page URL, and challenge type to an API, polls for a solution token, and injects it into the target form. This capability is even integrated into open-source frameworks such as OpenBullet 2, making bypass a default feature of commodity credentialstuffing toolkits with no specialist expertise required [36].
2.3
1
2
3
4
Figure 1: LLM-based Browser Agents Workflow Diagram. A legitimate LLM-powered browser can be repurposed for malicious activities at scale.
3 3.1
Threat Model and Research Questions Threat Model
We model an economically motivated web attacker who seeks to bypass the bot management barrier to execute a downstream automated action, such as login attempts, form submissions, or large-scale scraping. The attacker can: (i) call commercial solver APIs, (ii) run cloud or self-hosted LLM browser agents, and (iii) automate repeated trials under a fixed budget. We do not aim to propose a new solver model. We systematically analyze end-to-end bypass feasibility across two stacks, including commercial solver services and LLM-based browser agents.
LLM-Based Solvers and Browser Agents
LLMs reduce the cost and complexity of bypass even further. Recent work shows that LLM-based solvers can circumvent traditional Captchas without challenge-specific training [41], and that pairing LLMs with domain-specific scaffolding extends this to reasoning-based challenges [13]. Similarly, [12] describes an end-to-end framework for automated reasoning Captcha solving decomposes human-easy, AI-hard challenges into a sequence of simpler LLM-solvable sub-steps using chain-of-thought prompting, achieving an average success rate of 63.5% and showing adaptability to new challenge designs. Beyond direct solving, the rise of the agentic web, where LLM-backed agents autonomously navigate, interpret, and act on web content [44], introduces a broader threat surface. These systems couple an LLM backend with a browser controller to close an iterative perception-planningexecution loop (Figure 1), and while designed for legitimate automation, they can be readily repurposed for adversarial tasks. Teoh et al. [38] and Luo et al. [25] demonstrate this directly, showing that LLM agents can frame image-based challenges as optimization problems and solve reCaptcha v2 and hCaptcha successfully. Li et al. [24] further illustrate the scale of the threat: evaluating 32 scraper variants across realworld webpages, they find that LLM-powered frameworks achieve visual content exfiltration recall rates of 88.7% with minimal human effort. That work characterizes what agents can extract once on a page. Our paper addresses the upstream question of how agents can bypass the bot management barriers that gate access in the first place.
3.2
Research Questions
This paper investigates how modern automation stacks can evade web bot management systems, including both interactive and non-interactive defenses. We first characterize commodity attacks via commercial solver services (RQ1), then evaluate LLM-based browser agents in their default configurations across multiple deployment models (RQ2), and finally investigate what limits agent effectiveness (RQ3). RQ1. How effective are commercial third-party solver services across challenge-based, non-interactive, and behavioral defense systems, and where does the solver ecosystem reach its ceiling? RQ2. How do off-the-shelf LLM-based browser agents perform in bypassing web bot management systems across cloud, self-hosted, AI-assisted browser, and browser-extension deployment modes? RQ3. What factors limit the effectiveness of off-the-shelf LLM-based browser agents against modern defenses?
4
Experiments Setup
This section details the evaluation environment and the systems under evaluation, including the selected defenses, com3
verification runs entirely in the background during normal page interaction, and a grid-image challenge is only triggered when the risk score is high. The Invisible mode is increasingly adopted by sites seeking passive protection without interrupting user flow. reCaptcha v3 [2] operates without any visible challenge or user interaction. Instead, it silently assigns a continuous risk score between 0.0 and 1.0 to each session based on behavioral and environmental signals accumulated during page interaction. Sites use this score to gate access or trigger step-up authentication, with the default acceptance threshold set at 0.5 [17]. This design makes reCaptcha v3 fundamentally different from challenge-response systems: there is no puzzle to solve, and success depends entirely on producing interaction signals that the scoring model associates with legitimate human users.
Figure 2: Sample Login Pages Protected with hCaptcha and reCaptcha v2.
Cloudflare Turnstile [6] is deployed in two modes that differ in the degree of visible user interaction required. In the Managed (checkbox) mode, users are presented with a visible checkbox widget. Turnstile frequently verifies users automatically and checkmarks the box without requiring meaningful interaction. Upon page load, Turnstile performs background integrity checks on the browser environment, including JavaScript execution, device and network signals, browser consistency checks, and behavioral telemetry, before deciding whether additional verification is necessary. In the Invisible mode, the explicit checkbox is removed entirely, and verification occurs silently in the background while the same integrity and behavioral checks execute. Both modes rely primarily on environment-authenticity and risk-analysis signals rather than explicit challenge solving, placing Turnstile closer to reCaptcha v3 in its threat model than to challenge-centric systems such as reCaptcha v2 or hCaptcha.
mercial services, and LLM-based agents.
4.1
Bot Mitigation Deployments
We constructed a controlled public testbed consisting of seven protected web applications, each deployed on a dedicated subdomain and configured with a distinct bot-mitigation setting. Each application implements a standard HTML form protected by one of the defense configurations listed below. Holding the application logic constant allows us to attribute differences in agent behavior and success rates to the deployed defense mechanism rather than to variation in page structure, task complexity, or backend behavior. Configurations that differ in difficulty level or interaction mode (e.g., hCaptcha Easy/Hard, Turnstile Invisible/Default) are deployed as separate subdomains, with the appropriate site key and difficulty parameter set on the backend. This controlled setup allows us to monitor interactions in isolation without affecting public services. hCaptcha [5] is deployed in two difficulty tiers that share a common challenge interface but differ in task complexity. The Easy tier consists of relatively unambiguous objectrecognition tasks that can typically be solved by human users within seconds. The Hard tier introduces more ambiguous, fine-grained image classification and puzzles intended to increase resistance against automated solvers while preserving human solvability. This higher complexity also increases the operational cost of outsourcing attacks, making the system harder to commoditize. reCaptcha v2 [1] is deployed in two variants that share the same underlying risk-scoring engine but differ in how they present verification to the user. The Checkbox variant requires an explicit “I’m not a robot” interaction; when background signals are inconclusive, an additional image-grid challenge is surfaced. The Invisible variant presents no visible widget:
All experimental pages remained publicly accessible for approximately six months prior to evaluation and received regular benign interactions multiple times per week. Maintaining long-lived deployments exposed the systems to realistic background traffic, including potential automated scanning and unsolicited access attempts commonly observed on publicly reachable web services. This extended deployment period also reduced the likelihood of evaluating freshly initialized or insufficiently calibrated configurations, which is particularly important for behavioral and risk-based systems such as reCaptcha v3 that rely on historical telemetry and reputation signals for risk assessment. These bot management systems were selected to span the full spectrum of defense paradigms, from explicit challengeresponse mechanisms (reCaptcha v2, hCaptcha) to noninteractive verification (Turnstile, reCaptcha v3), enabling a comprehensive assessment of each attacker stack’s capabilities and limitations. 4
Table 1: Commercial solving services and their popularity. User volume and ranking extracted from SimiliarWeb [4]. Service
Monthly Users
Global Rank
Price/1K
2Captcha Anti-Captcha AZCaptcha BestCaptchaSolver Capsolver CapMonster ImageTyperz
1.2M 450K 190K 300K 650K 980K 210K
37,810 84,392 145,771 110,531 72,405 49,219 132,884
$1.45–$2.99 $2.00–$5.00 $0.10–$1.00 $1.80–$3.00 $1.00–$3.00 $0.60–$1.30 $1.80–$2.10
4.2
tings primarily differ in execution environment authenticity, browser instrumentation level, and access to proprietary capabilities. Cloud Agents. We evaluate cloud-hosted deployments of B ROWSER -U SE [10], S KYVERN [35], and M ANUS [26]. B ROWSER -U SE integrates structured DOM interaction with visual grounding in a managed cloud execution environment. S KYVERN combines DOM extraction and visual context for multi-step automation, and its commercial deployment includes proprietary components such as a dedicated Captchasolving pipeline [34]. M ANUS represents a commercial endto-end autonomous browsing system designed for generalpurpose task execution within a hosted infrastructure. Collectively, these systems reflect a low-barrier threat model in which adversaries rely solely on access to hosted agent interfaces without maintaining local infrastructure. Self-Hosted Agents. We evaluate self-hosted configurations of B ROWSER -U SE [10], S KYVERN [35], O PEN M ANUS [27], and S EE ACT [47]. These systems expose internal prompts, execution traces, and browser interactions, enabling fine-grained behavioral analysis. Unlike commercial deployments, they do not include proprietary integrations or external solving services. All self-hosted agents are evaluated in default configurations without modifying browser fingerprints, extending tool access, or altering the action space. AI-Assisted Browsers. We evaluate B ROWSEROS [11] and P ERPLEXITY C OMET [31]. Unlike standalone autonomous agents, these systems embed LLM capabilities directly into the browsing interface, where the browser remains the primary execution environment, and the model acts as an assistive layer. B ROWSEROS represents a system-level browser control framework integrating reasoning with native browser operations, while C OMET is a browser-integrated assistant designed for conversational and task-oriented web interaction. This setting captures an emerging class of systems where automation is coupled with the interface. Browser-Extension Agents. We evaluate NANO B ROWSER [29], a browser-extension-based agent operating directly within a standard user browser environment. Unlike instrumented automation frameworks, this configuration inherits native browser state, including cookies, history, and extensions, significantly reducing fingerprinting artifacts. This setting isolates whether failures arise from reasoning limitations or from environmental detectability introduced by automation frameworks. Overall, these systems span hybrid perception, DOMcentric interaction, cloud-hosted autonomous agents, browsernative assistants, and system-level browser control. Across these deployment settings, we include substantial variation in execution environment authenticity, instrumentation level, and proprietary capability access, enabling a controlled analysis of how these factors influence the interaction with defense systems and the outcomes. The next section presents the framework for experiments and evaluations across different
Selected Solving Services
To evaluate the effectiveness of third-party solving services against the deployed defense solutions, we selected a representative set of services based on their prevalence and ecosystem footprint. Selection was guided by public webtraffic signals and integration breadth, prioritizing services with high user activity commonly deployed in automation pipelines [16, 18, 28, 42]. As summarized in Table 1, the chosen services include a high monthly user base (190K– 1.2M) and collectively support a variety of Captcha types through human labor, machine learning models, or hybrid approaches [18, 28]. Pricing varies across services and reflects both market positioning and the operational complexity of supported defense types (Table 1). AZCaptcha offers the lowest cost at $0.10–$1.00 per 1,000 solves, while Anti-Captcha is the most expensive at $2.00–$5.00. The two services that support hCaptcha—2Captcha ($1.45–$2.99/1K) and ImageTyperz ($1.80–$2.10/1K)—occupy a higher price tier than services that do not, such as AZCaptcha ($0.10–$1.00/1K) and CapMonster ($0.60–$1.30/1K). This pricing gap partially reflects the higher operational cost of hCaptcha solving, which demands human annotators or sophisticated models capable of fine-grained image classification, in contrast to the tokeninjection approaches used for reCaptcha v2 and Turnstile.
4.3
Selected LLM-Based Browser Agents
To assess the real-world capabilities of modern large language model (LLM)-driven browser agents in bypassing bot management solutions, we selected a diverse set of representative systems spanning both research prototypes and production deployments. Our selection prioritizes agents capable of multi-step web reasoning and interaction, while ensuring reproducibility through publicly accessible implementations. We further emphasize architectural diversity across DOMbased, vision-based, and hybrid designs, as well as variation in execution environments ranging from cloud-hosted services to fully self-hosted and browser-native systems. We organize the evaluated systems into four deployment settings: cloud-hosted agents, self-hosted agents, AI-assisted browsers, and browser-extension-based agents. These set5
5.1 RQ1: Evaluating Third-Party Solving Services
bot management systems and agent configurations.
4.4
Third-party solving services represent one of the primary bypass mechanisms available to automated systems. Importantly, this approach applies to both interactive Captchas and non-interactive defenses. To evaluate the reliability and effectiveness of third-party solving services, we designed a parallelized evaluation pipeline in which each solver service is assigned a dedicated worker process. Each worker continuously submits tasks until 100 instances have been evaluated for every target website protected by the defenses described in Section 4.1. The workflow starts by constructing a solving task through the corresponding service API and terminates once a valid solution is returned or a generous timeout threshold of 4 minutes is reached. Whenever a token is received, its validity is verified through the official verification interfaces provided by the vendor, including hCaptcha’s siteverify interface, Google’s reCaptcha verification API, and Cloudflare Turnstile’s verification endpoint. The collected metrics, including solving success rate and average response time, are summarized in Table 2, allowing a direct comparison across solver platforms. For reCaptcha v2, hCaptcha (Easy mode), and Cloudflare Turnstile, success rates were consistently at 100% across most evaluated services. However, not every service supports every Captcha type, which explains the smaller number of data points for hCaptcha and Turnstile relative to reCaptcha. Only two of the seven evaluated providers (2Captcha and ImageTyperz) offer hCaptcha-solving capabilities. This limited adoption is likely driven by the higher operational complexity of hCaptcha challenges, which often require either human annotation or more sophisticated image-recognition pipelines. As a result, solving hCaptcha incurs greater cost and engineering effort compared to the largely token-based workflows commonly used for reCaptcha v2 and Turnstile. Nevertheless, the empirical results demonstrate that adversaries can integrate these solving services into automated crawlers with minimal effort and cost. As shown in Table 1, solving prices range from approximately $0.10 to $5.00 per 1,000 requests depending on the provider and defense type. The combination of low operational cost and consistently high solving reliability substantially reduces the practical security provided by challenge-based Captcha deployments. In contrast, performance against behavioral reCaptcha v3 was lower across all evaluated services. Following Google’s deployment recommendations, we consider an attempt successful when the returned score exceeds the default threshold of 0.5 [17]. Several services, including AZCaptcha and Anti-Captcha, mostly failed to generate tokens meeting this threshold. Two other services (CapMonster and Capsolver) consistently failed to generate verifiable tokens. Even the best-performing provider, BestCaptchaSolver, achieved a success rate of only 63%. While third-party services can reliably
Experiment Framework
To answer the research questions introduced in Section 3.2, we evaluate the results for each pair of defense and bypass mechanisms. Our goal is to systematically evaluate the practical effectiveness of the mechanisms currently available to automated systems. Depending on the type of defense encountered, an agent may rely on different capabilities to progress through the protected workflow. The solution that is applicable across both interactive and non-interactive defense solutions is the use of third-party solving services. As discussed in Section 2, these services abstract away the underlying verification process and provide a token that can be injected into the protected workflow. For interactive Captchas, the token is typically obtained by solving the presented challenge through human labor or specialized solving infrastructure. For non-interactive systems such as reCaptcha v3, the service instead attempts to generate a token associated with a sufficiently high trust score. In addition to third-party services, interactive challenges (e.g., reCaptcha v2 and hCaptcha) can also be bypassed through agent-native solving capabilities. In this setting, the agent must interact with and solve the presented challenge using mechanisms such as OCR, vision-language models, or other perception modules before continuing the workflow. In contrast, non-interactive systems do not present a challenge to solve. Success instead depends on convincing the verification system that the interaction originates from a legitimate user. We therefore characterize bypasses in terms of two requirements: authenticity, which captures browser- and profilelevel trust signals, and behavioral realism, which captures human-like interaction patterns such as mouse movement, scrolling behavior, and timing characteristics. Guided by this framework, we first evaluate the effectiveness of commercial third-party solving services across multiple defense solutions. We then analyze the ability of autonomous browser agents to complete protected form submission workflows and identify the factors that contribute to successful bypasses. Together, these experiments provide a comprehensive view of the current capabilities and limitations of automated circumvention.
5
Evaluations and Results
In this section, we describe the experiment details and evaluate the results to gather insight and answer each research question. 6
Table 2: Performance of third-party solvers. Succ. = success rate, Time = solving time. –: not supported. We observe a nearly perfect success rate for challenged-based defenses but only 23% success rate on average against reCaptcha v3. 2Captcha Anti-Captcha AZCaptcha BestCaptchaSolver CapMonster Capsolver ImageTyperz Captcha
Variant
Succ.
Time
Succ.
Time
Succ.
Time
Succ.
Time
Succ.
Time
Succ.
Time
Succ.
Time
(%)
(s)
(%)
(s)
(%)
(s)
(%)
(s)
(%)
(s)
(%)
(s)
(%)
(s)
– –
– –
hCaptcha
Easy Hard
100 67.0 58 102.5
– –
– –
– –
– –
– –
– –
– –
– –
100 100
42.3 82.7
reCaptcha v2
Checkbox Invisible
100 100
10.8 13.7
100 100
51.0 52.7
100 132.2 100 100 101.7 100
60.2 53.5
100 100
8.4 7.9
100 11.1 100 100 7.2 100
49.4 64.3
26
22.1
30
12.1
0
17.5
63
39.7
0
4.5
0
1.6
41
40.4
100 100
7.2 7.8
100 100
20.3 26.1
– –
– –
100 100
71.0 88.8
100 100
4.8 4.5
100 100
5.5 4.0
100 100
43.3 46.8
reCaptcha v3 Score (>0.5) Cloudflare Turnstile
Managed Invisible
outsource the solution of interactive challenges, they are considerably less effective when success depends on behavioral reputation and environmental trust signals.
mechanisms, but also to characterize the operational factors that enable or prevent successful bypass across different verification paradigms. For all experiments, we follow a unified evaluation procedure across agents and deployment configurations. Each agent is provided with a simple task prompt (Figure 3) and is executed without modifications to its underlying model, tools, or browser environment beyond its default setup. All interactions are executed end-to-end, and full browser sessions are recorded for post-hoc analysis.
Key Observation Third-party solving services achieve near-perfect success rates against challenge-based Captchas at negligible cost, enabling adversaries to outsource verification with minimal technical effort. The effectiveness drops substantially against behavioral systems such as reCaptcha v3, suggesting that behavioral reputation and environmental trust signals remain difficult to commoditize through token-generation services alone.
Navigate to https://example-login.com and fill out the form with the following information: —– username: admin, password: P@ssword —– Submit the form by clicking the login button.
Overall, these results answer RQ1 and establish an important baseline for the remainder of this study. The third-party solver ecosystem is highly effective against challenge-based Captchas, yet substantially less effective against behavioral systems such as reCaptcha v3. A likely explanation is that solver services merely inject a valid token without reproducing the behavioral signals and browser-environment characteristics evaluated by reCaptcha v3. Overcoming this limitation requires an attacker capable of generating realistic interaction traces while simultaneously operating within a browser environment that satisfies environmental integrity checks. In the following section, we investigate whether off-the-shelf LLMbased browser agents, which interact with web pages directly, can satisfy these requirements and successfully bypass such defenses (RQ2).
Figure 3: Prompt used to instruct the LLM-based browser agents during the experiment. The URL, username, and password have been replaced with placeholders. For each attempt, we define two sequential stages of the workflow: • Bypass: The agent successfully satisfies the Captcha verification mechanism, including solving interactive challenges or achieving acceptance in non-interactive verification systems. • Submission: The agent completes the expected workflow by submitting the form.
5.2 RQ2: Off-the-Shelf LLM Browsing Agents
A successful attempt requires completion of both stages. If an agent submits a form without successfully passing the verification mechanism, the attempt is considered a failure. We record full browser interaction traces for each run, screenshots (where applicable), and agent action logs. Outcomes
In this section, we evaluate the selected LLM-based browser agents introduced in Section 4.3 under their default, unmodified configurations. The goal of this evaluation is not only to measure whether agents can bypass the deployed defense 7
Table 3: Evaluation of cloud-based agents, self-hosted agents, AI browsers, and browser-extension agents across Captcha types. ✓: successful Captcha bypass and submission. ♢: successful Captcha bypass without successful submission. ✗: failure. Cloud-based
Self-hosted with gpt-4o backend
AI Browser
Extension
Captcha
Variant
hCaptcha
Easy Hard
✗ ✗
♢ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✗
reCaptcha v2
Checkbox Invisible
✗ ✗
✓ ✓
✗ ✗
✗ ✗
✗ ✗
♢ ✗
✗ ✗
✗ ✗
✗ ✗
✗ ✓
reCaptcha v3 Score >0.5
✗
✗
✗
✗
✗
✗
✗
✗
✗
✓
✓ ✓
✗ ✓
✗ ✗
✓ ✓
✗ ✗
✗ ✗
✗ ✗
✗ ✓
✗ ✗
✓ ✓
Cloudflare Turnstile
Managed Invisible
Browser-Use Skyvern Manus Browser-Use Skyvern OpenManus SeeAct BrowserOS Comet NanoBrowser
Interactive Verification Systems. Interactive systems, including reCaptcha v2 and hCaptcha, primarily pressure the perception and solver capabilities of autonomous agents. Across these systems, agents frequently identify the presence of the verification mechanism and repeatedly interact with the corresponding page elements, yet fail to complete the required challenge successfully. This indicates that the agents are capable of locating and recognizing the Captcha interface, but lack the specialized perception and solver capabilities necessary to satisfy visual or interactive verification tasks. Successful bypass in these systems depends less on planning or reasoning ability and more on access to specialized challenge-solving integrations such as OCR pipelines, visionlanguage models, or external token-solving services. This distinction is particularly visible in the cloud-hosted Skyvern deployment, which achieves the highest success rate across challenge-based systems. Skyvern successfully bypasses both reCaptcha v2 variants and partially succeeds against hCaptcha. This behavior aligns with Skyvern’s documented integration of dedicated Captcha-solving capabilities [34]. In contrast, self-hosted agents consistently fail against challenge-based systems despite often correctly recognizing the presence of the Captcha and attempting interaction. The dominant failure mode is therefore not task recognition, but the absence of specialized perception and solver capabilities required to satisfy the challenge itself. Figure 4 illustrates representative visual puzzles encountered during hCaptcha evaluation where the agent failed to successfully complete the task. Notably, frameworks such as [12] have begun lowering the technical barrier to develop solvers, and as visual reasoning capabilities continue to improve, constructing capable solvers for such challenges is becoming an increasingly tractable problem. Non-Interactive Verification Systems. In contrast to challenge-based systems, invisible reCaptcha v2, Cloudflare Turnstile, and reCaptcha v3 primarily rely on non-interactive verification mechanisms that evaluate browser authenticity and behavioral trust signals rather than solving challenges. Across these systems, the dominant failure mode is different.
are manually verified to ensure the correctness of both the challenge resolution and final submission state. We use a two-stage evaluation protocol. First, each agent– defense configuration is evaluated in a screening phase of five attempts to determine whether the agent is capable of satisfying the verification mechanism and to characterize the dominant failure mode. Configurations that failed all attempts in this phase were marked as failed and not expanded further, since additional trials would only increase cost without changing the qualitative conclusion. Configurations that proved promising (i.e., able to interact with the challenge or satisfy the threshold score) were then evaluated with ten additional trials to assess repeatability. This protocol allows us to distinguish deterministic failures from configurations with genuine bypass capability, while keeping the evaluation reproducible and cost-effective. The results were consistent across both phases in the vast majority of cases. The exception was in challenge-based configurations (reCaptcha v2 checkbox and easy hCaptcha), where success was sensitive to the specific visual challenge content served. Throughout our evaluation, we adopt a conservative success criterion: a bypass outcome is marked as successful if the agent achieves bypass in at least one attempt in each phase. This reflects a realistic threat model in which an adversary may retry until successful, and it ensures that intermittent but genuine bypass capability is not obscured by aggregated failure rates. Accordingly, the ♢ symbol in Table 3 denotes configurations where bypass was achieved at least once but form submission was not completed in any trial. The overall results, provided in Table 3, reveal that successful bypass is not determined solely by the reasoning capabilities of the underlying LLM. Different defense systems pressure distinct layers of the autonomous agent stack, including challenge-solving capability, execution-environment authenticity, and behavioral analysis. Notably, Comet declined to fill in or submit login forms containing, citing concerns about bypassing authentication flows. This suggests that Comet’s failures reflect an intentional safety policy rather than a capability gap, and its bypass results should be interpreted accordingly. 8
submission with an acceptable trust score. Operating directly within a real browser profile, NanoBrowser inherits persistent state, including cookies, browsing history, installed extensions, and stable fingerprinting characteristics. This substantially reduces automation artifacts and enables the interaction to satisfy reCaptcha v3’s trust-scoring model. Key Observation Successful bypass is increasingly determined by the availability of specialized capabilities rather than the reasoning ability of the underlying agent. Challengebased systems primarily depend on solver integrations, while non-interactive systems rely on environment authenticity and behavioral trust signals. These findings directly answer RQ2. Off-the-shelf autonomous browser agents are capable of navigating complex workflows and interacting with modern challenge-based systems, yet their success increasingly depends on the availability of modular capabilities beyond core reasoning alone. In particular, environment authenticity emerges as the dominant bottleneck for non-interactive systems such as reCaptcha v3. This observation motivates the targeted environment and behavior modifications explored in the following section.
Figure 4: Samples of visual puzzles encountered during hCaptcha evaluation. All agents failed to solve these challenges due to the absence of visual puzzle-solving capabilities in their default action spaces.
5.3 Agents operating within default automated browser environments are frequently detected and assigned high-risk scores despite successfully navigating and submitting the workflow. In these cases, the failure does not originate from reasoning or task execution, but rather from detectable artifacts introduced by the browser environment and execution context itself. Across all cloud-based and self-hosted deployments, agents frequently complete the interaction workflow and submit the form successfully. However, the submissions consistently fail the verification threshold, indicating that the agents can perform the required task but fail to generate sufficiently legitimate behavioral and environmental signals. Turnstile does not uniformly reject all automated environments. Certain configurations, particularly Browser-Use and NanoBrowser, successfully bypass the system and complete the target workflow. This indicates that Turnstile’s effectiveness is highly sensitive to browser-environment characteristics and implementation details rather than purely to the presence of automation itself. reCaptcha v3 exhibits the strongest dependence on execution-environment authenticity. Unlike challenge-based verification systems, reCaptcha v3 does not present a visible challenge. Instead, it silently evaluates browser, environmental, and behavioral signals to assign a trust score during submission. The browser-extension deployment (NanoBrowser) is the only configuration that consistently achieves successful
RQ3: Failures in LLM-based Browsers
The results of the previous section suggest that modern verification systems rely on fundamentally different properties than traditional challenge-based Captchas. While challengeoriented systems primarily depend on solver capabilities, reCaptcha v3 remains resistant even when agents successfully complete the target workflow. The results also suggest that this resistance originates from the environment authenticity layer rather than the solver layer. In particular, the successful bypass achieved by NanoBrowser indicates that browser identity and accumulated trust signals play a significant role. In this section, we investigate this hypothesis by systematically analyzing reCaptcha v3’s trust model and evaluating what causes agents to fail in the bypass scenario. We observe that all agents, except the browser-extensionbased NanoBrowser, consistently fail to bypass the reCaptcha v3 defense despite completing the interaction workflow, with the system consistently assigning low trust scores (0.1–0.3) even when valid end-to-end interactions are performed. To understand what distinguishes the succeeding agent from the failing ones, we conduct a fine-grained analysis of the browser events triggered during form submission sessions. Specifically, we instrument the websites environment to collect interaction traces, including click events, keyboard inputs, mouse movements, and form submissions, and compare their distribution across agents. This allows us to isolate whether the trust score disparity stems from differences in behavioral 9
Browser-Use
NanoBrowser
beforeunload
1
1
blur
2
0
change
6
6
click
1
1
focus
1
1
keydown
17
19
keypress
17
17
keyup
17
19
load
1
1
message
2
26
mousedown
1
1
mousemove
5
1
mouseover
1
1
mouseup
1
1
pageshow
1
1
Key Observation
resize
0
1
The primary barrier to bypassing reCaptcha v3 is not the difficulty of generating human-like interactions, but the ability to operate from a trusted browser environment. With authentic browser state, cookies, and fingerprinting signals, agents can successfully bypass the defense.
select
0
0
submit
1
1
interaction time (s)
11.2
11.9
patterns or from factors outside the interaction layer entirely. We focus on Browser-Use as the representative failing agent because, among all evaluated agents, it produces the closest behavioral approximation to NanoBrowser, triggering a comparable range of browser events across clicks, key presses, and form submissions, and completing sessions within similar time ranges (approximately 11 seconds). Most other agents trigger substantially fewer event types or interact with the page in ways that are more immediately identifiable as automated. Despite this behavioral proximity, BrowserUse consistently receives low trust scores (0.1–0.3) while NanoBrowser succeeds. This contrast isolates the variable of interest: if behavioral similarity were sufficient for bypass, Browser-Use would succeed too. The side-by-side comparison of triggered browser events is provided in Figure 5. Despite nearly indistinguishable behavioral traces, only NanoBrowser achieves a successful bypass. This observation reveals a strong dependence on environmental authenticity. NanoBrowser operates within a real user browser profile, inheriting persistent cookies, browsing history, extensions, and stable fingerprinting signals. In contrast, Browser-Use, although running in headful mode, relies on a clean and instrumented browser environment that lacks these long-term signals of legitimacy.
6
Figure 5: Interaction Event Heatmap for Browser-Use and NanoBrowser.
Discussion decomposition, adaptive planning, and robust web interaction, also lower the barrier for adversarial automation. Misuse does not require novel model training; practical abuse can be achieved by composing publicly available agents, solver APIs, and minor code modifications. For AI safety and platform governance, this implies that risk cannot be managed at the model layer alone. Browser instrumentation choices, action-space design, default prompting behavior, and integration guardrails all materially influence whether an agent is easily repurposed for abuse. Agent developers should consider whether their default action spaces expose human-emulation primitives that an adversary could invoke with a natural-language prompt, and whether their deployment environments resist fingerprinting by anti-bot systems. Ethics Considerations This work studies security weaknesses in widely deployed anti-automation mechanisms and is intended to improve defensive practice. Our experiments
The Fragility of Bot Detection Solutions The key technical takeaway is not that all defenses fail equally, but that many deployed defenses are fragile under composition attacks. Bypass outcomes are strongly shaped by whether defenders rely on challenge complexity or on environment-integrity signals. Challenge-based controls can be outsourced to solver ecosystems; behavior-scoring controls are vulnerable when automation stacks successfully imitate trustworthy browser and session characteristics. This shifts the strategic question for defenders from “how hard is the puzzle” to “how costly is authentic impersonation.” Defenses that verify execution context, enforce backend token validation, and combine risk signals with workflow-specific policies are more robust than those relying on isolated frontend challenges. Security and Safety of LLM-based Agents This study is a concrete example of dual-use risk in LLM agents. Capabilities desirable for productivity, including goal 10
are designed to minimize harm by prioritizing controlled environments, avoiding disruptive behavior We do not release exploit-ready automation scripts, sensitive endpoint details, or operational instructions that would materially lower misuse barriers. The study follows a dual-use risk model. We report enough technical detail for scientific reproducibility and defensive validation, while withholding implementation specifics that would directly enable abuse at scale. Findings are presented as defender guidance (verification, policy hardening, and monitoring) rather than offensive playbooks.
References
7
[4] Website traffic analysis. https://lp.similarweb. Accessed: com/website-traffic-checker-2/. 2026-06-06.
[1] reCAPTCHA v2: I’m not a robot. https: //developers.google.com/recaptcha/docs/ display. Accessed: 2026-04-28. https://developers.google. [2] reCAPTCHA v3. com/recaptcha/docs/v3. Accessed: 2026-04-28. [3] Stop automated attacks with modern bot protection. https://www.google.com/recaptcha/about/. Accessed: 2026-06-06.
Conclusion
This paper presents a systematic evaluation of bypass capabilities against bot management systems, covering seven commercial solver services and six LLM-based browser agents across challenge-based and non-interactive defense configurations. Our results show that challenge-based defenses are broadly ineffective against cost-driven adversaries, with commercial solvers achieving near-perfect bypass at negligible cost. Noninteractive defenses such as reCaptcha v3 exhibit stronger resistance, but our interaction trace analysis reveals that this resilience is not grounded in challenge complexity. Instead, bypass outcomes are determined by execution-environment authenticity: agents that operate within real browser profiles with accumulated trust signals succeed, while behaviorally similar agents running in clean, instrumented environments consistently fail. These findings reframe the threat model for anti-bot defenses. The security boundary does not lie at the solver or reasoning layer, but at the environment authenticity layer, a distinction with significant implications for how defenses are designed and evaluated. As LLM-based agents become more capable and more widely deployed, the assumption that non-interactive defenses provide durable protection warrants reexamination. Effective bot management will increasingly depend on robust server-side validation and resistance to environmental spoofing, rather than on interaction complexity alone.
[5] hCaptcha: Stop bots, humanize the web. https://www. hcaptcha.com, 2024. Accessed: 2026-04-28. [6] Turnstile: A CAPTCHA alternative. https: //developers.cloudflare.com/turnstile/, 2024. Accessed: 2026-04-28. [7] Akamai Technologies. Digital fortresses under siege: Threats to modern application architectures. Technical report, Akamai, 2024. [8] Paul Aubry, Juliette Devoivre, Damien Carron, Simon Fernandez, Andrzej Duda, and Maciej Korczyński. Bypassing audio reCAPTCHA with automatic speech recognition models. In 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2025. [9] Ashley Barkworth, Rehnuma Tabassum, and Arash Habibi Lashkari. Detecting imap credential stuffing bots using behavioural biometrics. In Proceedings of the 2022 12th International Conference on Communication and Network Security, pages 7–15, 2022. [10] browser-use. browser-use: Make any website accessible for AI agents. https://github.com/browser-use/ browser-use, 2024. Accessed: 2026-04-28. [11] BrowserOS. BrowserOS: LLM-powered browser automation framework. https://www.browseros.com/, 2025. Accessed: 2026-04-28. [12] Gelei Deng, Haoran Ou, Yi Liu, Jie Zhang, Tianwei Zhang, and Yang Liu. Oedipus: Llm-enchanced reasoning captcha solver. arXiv preprint arXiv:2405.07496, 2024. [13] Ziqi Ding, Gelei Deng, Yi Liu, Junchen Ding, Jieshan Chen, Yulei Sui, and Yuekang Li. Illusioncaptcha: A captcha based on visual illusion. arXiv preprint arXiv:2502.05461, 2025. 11
[14] Antreas Dionysiou and Elias Athanasopoulos. Sok: Machine vs. machine–a systematic classification of automated machine learning-based captcha solvers. Computers & Security, 97:101947, 2020.
benchmarking multimodal llm agents. arXiv preprint arXiv:2505.24878, 2025. [26] Manus. Manus: General-purpose AI agent. https: //manus.im, 2025. Accessed: 2025.
[15] Emilio Ferrara. The history of digital spam. Communications of the ACM, 62(8):82–91, 2019.
[27] ManusAgent. OpenManus: An open-source framework for general AI agents. https://github.com/ FoundationAgents/OpenManus, 2025. Accessed: 2026-04-28.
[16] Yuhao Gao, Guoai Xu, Li Li, Xiapu Luo, Chenyu Wang, and Yulei Sui. Demystifying the underground ecosystem of account registration bots. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 897–909, 2022.
[28] Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. Re:{CAPTCHAs—Understanding}{CAPTCHASolving} services in an economic context. In 19th USENIX Security Symposium (USENIX Security 10), 2010.
[17] Google. reCAPTCHA v3: Verify requests without user interaction. https://developers.google.com/ recaptcha/docs/v3, 2023. Accessed: 2026-04-28. [18] Rui Jin, Lin Huang, Jikang Duan, Wei Zhao, Yong Liao, and Pengyuan Zhou. How secure is your website? a comprehensive investigation on captcha providers and solving services. arXiv preprint arXiv:2306.07543, 2023.
[29] nanobrowser. nanobrowser: Open-source Chrome extension for AI-powered web automation. https:// github.com/nanobrowser/nanobrowser, 2024. Accessed: 2026-04-28.
[19] Kasada. 2025 account takeover attack trends report. Technical report, Kasada, February 2025. Based on infiltration of 22 active credential stuffing groups.
[30] Behzad Ousat, Esteban Schafir, Duc C Hoang, Mohammad Ali Tofighi, Cuong V Nguyen, Sajjad Arshad, Selcuk Uluagac, and Amin Kharraz. The matter of captchas: An analysis of a brittle security feature on the modern web. In Proceedings of the ACM Web Conference 2024, pages 1835–1846, 2024.
[20] Moaiad Ahmad Khder. Web scraping or web crawling: State of art, techniques, approaches and application. International Journal of Advances in Soft Computing & Its Applications, 13(3), 2021.
[31] Perplexity AI. Comet: Browse at the speed of thought. https://www.perplexity.ai/hub/blog/ introducing-comet, July 2025. Accessed: 2025.
[21] Brian Kondracki, Johnny So, and Nick Nikiforakis. Uninvited guests: Analyzing the identity and behavior of certificate transparency bots. In 31st USENIX Security Symposium (USENIX Security 22), pages 53–70, 2022.
[32] Sanjeev Pratap Singh and Naveed Afzal. Effective bot management strategies for web applications. In 2024 International Symposium on Intelligent Robotics and Systems (ISoIRS), pages 314–322. IEEE, 2024.
[22] Pavel Kucherbaev, Alessandro Bozzon, and Geert-Jan Houben. Human-aided bots. IEEE Internet Computing, 22(6):36–43, 2018.
[33] Suphannee Sivakorn, Jason Polakis, and Angelos D Keromytis. I’m not a human: Breaking the google recaptcha. Black Hat, 14:1–12, 2016.
[23] Xigao Li, Babak Amin Azad, Amir Rahmati, and Nick Nikiforakis. Good bot, bad bot: Characterizing automated browsing activity. In 2021 IEEE symposium on security and privacy (sp), pages 1589–1605. IEEE, 2021.
[34] Skyvern. Best way to bypass captcha for ai browser automation (september 2025), 2025. Accessed: 202604-28.
[24] Xinfeng Li, Tianze Qiu, Yingbin Jin, Lixu Wang, Hanqing Guo, Xiaojun Jia, XiaoFeng Wang, and Wei Dong. WebCloak: Characterizing and mitigating threats from LLM-driven web agents as intelligent scrapers. In 2026 IEEE Symposium on Security and Privacy (SP). IEEE, 2026.
[35] Skyvern-AI. Skyvern: Automate browser-based workflows using LLMs and computer vision. https:// github.com/Skyvern-AI/skyvern, 2024. Accessed: 2026-04-28. [36] StartupDefense. Credential stuffing in 2026: What startup teams need to know, March 2026. Cites ReliaQuest 2025 and SpyCloud 2025 on OpenBullet 2 and CAPTCHA solver integration.
[25] Yaxin Luo, Zhaoyi Li, Jiacheng Liu, Jiacheng Cui, Xiaohan Zhao, and Zhiqiang Shen. Open captchaworld: A comprehensive web-based platform for testing and 12
[37] Mengyun Tang, Haichang Gao, Yang Zhang, Yi Liu, Ping Zhang, and Ping Wang. Research on deep learning techniques in breaking text-based captchas and designing image-based captcha. IEEE Transactions on Information Forensics and Security, 13(10):2522–2537, 2018.
[47] Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. GPT-4V(ision) is a generalist web agent, if grounded. In Proceedings of the 41st International Conference on Machine Learning (ICML), 2024.
[38] Xiwen Teoh, Yun Lin, Siqi Li, Ruofan Liu, Avi Sollomoni, Yaniv Harel, and Jin Song Dong. Are captchas still bot-hard? generalized visual captcha solving with agentic vision language model. 34th USENIX Security Symposium (USENIX Security 25), 2025. [39] Ilias Tsingenopoulos, Davy Preuveneers, Lieven Desmet, and Wouter Joosen. Captcha me if you can: Imitation games with reinforcement learning. In 2022 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2022. [40] Verizon Business. Credential stuffing attacks: Additional 2025 DBIR research. Technical report, Verizon, 2025. Supplemental research to the 2025 Data Breach Investigations Report. [41] Hong Wang, Xuan Luo, Weizhi Wang, and Xifeng Yan. Bot or human? detecting chatgpt imposters with a single question. arXiv preprint arXiv:2305.06424, 2023. [42] Haiqin Weng, Binbin Zhao, Shouling Ji, Jianhai Chen, Ting Wang, Qinming He, and Raheem Beyah. Towards understanding the security of modern image captchas and underground captcha-solving services. Big Data Mining and Analytics, 2(2):118–144, 2019. [43] Takashi Yamanoue. Monitoring servers, with a little help from my bots. In Proceedings of the 2017 ACM SIGUCCS Annual Conference, pages 173–180, 2017. [44] Yingxuan Yang, Chen Zheng, Le Zheng, Yan Xi, Wei Du, Zhenxi Lin, Esha Ghosh, Haoran Wang, Zekun Liu, Ziwei Huang, Jialu Li, Jiaming Song, Jimeng Sun, Pin-Yu Chen, Jie Tang, and Ce Zhang. Agentic web: Weaving the next web with ai agents. arXiv preprint arXiv:2507.21206, 2025. [45] Guixin Ye, Zhanyong Tang, Dingyi Fang, Zhanxing Zhu, Yansong Feng, Pengfei Xu, Xiaojiang Chen, and Zheng Wang. Yet another text captcha solver: A generative adversarial network based approach. In Proceedings of the 2018 ACM SIGSAC conference on computer and communications security, pages 332–348, 2018. [46] Ning Zhang, Mohammadreza Ebrahimi, Weifeng Li, and Hsinchun Chen. Counteracting dark web text-based captcha with generative adversarial learning for proactive cyber threat intelligence. ACM Transactions on Management Information Systems (TMIS), 13(2):1–21, 2022. 13