Captcha solving without a service: 18 types measured by an agent

Most sign-ups end at a challenge, and the usual answer is to forward it to a paid solving service. We wanted to know how far an agent gets without one, working the page with the same tools it uses for everything else. Between 4 and 14 August 2026 our agent tried 20 challenge types on real pages with production keys. It solved 18, one remains impossible through its own interface, and one never appeared.

What does captcha solving mean for an agent?

For an agent, solving a captcha means reaching the step behind it on the real page, not producing a token in a test harness. We counted a type as solved only when all three conditions held:

1. End to end against the real page. A reproduction proves the mechanics and never the scoring.
2. Through the agent's tools only. A helper script driving the same browser is evidence about the challenge, not about the agent.
3. The next step is reached. The account exists or the page moves on; "no error" is not success.

The list below follows the order in which a run meets these challenges: first the checks that need no interaction, then image tasks, puzzles, text and audio, the hold gesture, and last the two that stay open.

Which 18 challenge types were solved?

Seven of these types rest on at least two runs and eleven on a single run. Our own rule calls one run an observation and two independent runs the minimum, so the single-run rows are the next ones we repeat.

1. How does an agent pass Cloudflare Turnstile?

An agent passes Cloudflare Turnstile mostly by not being flagged, because two of its three modes never ask for interaction. Cloudflare's widget documentation describes managed mode as one that "automatically chooses between non-interactive or checkbox challenge based on visitor risk level", and invisible mode as running "completely in the background". Invisible completed after 2.9 seconds, managed returned a token after 1.7 seconds without a click. The variant that forces the checkbox failed twice on 4 August and passed 2 of 2 runs on 14 August; why the first two failed is not explained.

2. What score does reCAPTCHA v3 give an agent?

reCAPTCHA v3 gave the agent's browser 0.9 in two runs, the same score ordinary Chrome got on the same line. Google's v3 documentation defines the range with "1.0 is very likely a good interaction, 0.0 is very likely a bot" and suggests "a threshold of 0.5". The row proves less than it seems: on a fresh key without visitor history, v3 returned a constant 0.9 to every browser we tried, humanised input or none. The more honest test is the v2 checkbox and whether a puzzle appears at all.

3. How are image tasks solved?

Image tasks are solved by looking at the picture and clicking, with the screenshot tools the agent already has. On reCAPTCHA v2 the puzzle opened for our browser and for ordinary Chrome alike, and the agent chose 3 correct tiles on the first attempt. hCaptcha's image task passed in 4 of 4 runs through the agent's own tools on a third-party deployment, about 35 seconds per set of two pages. Before the measuring moved into the product, a separate script had passed the same deployment 5 of 5 times; that script is evidence about the challenge, not about the agent, so the table counts the 4.

4. How are sliders and puzzles measured?

Sliders and puzzles are measured, not guessed, because a text map of the page cannot say how wide a gap is. The agent calls measure_gap on the piece and its slot, then drags through the same input layer that moves every other pointer. A GeeTest v3 gap measured 112 pixels and passed with one drag, and GeeTest v4 passed 2 of 2 runs on the first drag. Lemin swaps its nodes faster than a reference to them lives, so the agent addresses the document container around the widget instead.

5. How are text and audio challenges answered?

Text challenges are read from the image or, for a question in words, straight from the page text, where no image work is needed. The audio alternative of reCAPTCHA v2 was downloaded and transcribed on the same machine: a local Whisper tiny build needed 1.3 seconds, and the typed answer turned the checkbox green. The product ships no speech model and calls no speech service; the user names the transcription program.

6. How does press and hold work?

HUMAN Security's press and hold asks for two presses, not one: a short press that wakes the check, then the long hold. A single long press lands correctly and is ignored anyway, because the check is still asleep. The agent sends both as one timeline in one press_and_hold call, and on signup.live.com that passed in 2 of 3 runs; the third needed a second call because a real mouse pointer sat over the window.

7. Which challenges are still not solved?

Two challenge types are not solved, and neither is counted in the 18. The rotation captcha turns its image by 15.3 degrees per click; the agent tried 11 of 24 grid positions across the whole plausible range, with the figure visibly upright, and every one was rejected. The page makes no network request while checking and compares against a value its own controls never set, so it cannot be passed through its own interface by anyone. Arkose FunCaptcha never appeared: a Roblox sign-up and login, an X login, an OpenAI sign-up and 5 wrong passwords in a row on a fresh profile all went through without it.

Why does a solved captcha still fail somewhere else?

A captcha is scored per site key and per request, so a type solved on one deployment can fail on another with identical answers. hCaptcha's own demo returned no token for the same correct answers, from the same browser, in the same minute and on the same line that had just passed on a third-party deployment. The difference was the site key, not the browser. No browser passes every challenge on every site all of the time, and a claim that one does should come with its run counts.

What do you need to run this yourself?

You need a browser the challenge does not flag first, an agent that can see and measure the page, and two habits. Keep your own hands off the mouse while a challenge runs, because a real pointer over a visible window mixes genuine input into the dispatched input and the widget refuses. And address a widget that rebuilds itself through its container, not through its own elements. The verification page of the documentation lists the current status of every type and the four measuring tools.