Cloudflare Turnstile and AI agents: 3 variants, 1.7 to 2.9 seconds

Most of the time an agent does not solve Cloudflare Turnstile at all, because Turnstile never asks. On 4 August 2026 we ran our agent against three real pages that use Turnstile with production keys, in the same hour, with the same browser and profile. Two of the three returned a token without a single click, in 1.7 and 2.9 seconds. The third asked for a checkbox and refused the answer twice before it passed, and the most useful part of this case is that we cannot say exactly what changed.

What is Cloudflare Turnstile?

Cloudflare Turnstile is a challenge widget that decides in the background whether a visitor looks human and hands the page a token when it does. Cloudflare's widget documentation names three modes. Managed "automatically chooses between non-interactive or checkbox challenge based on visitor risk level", non-interactive shows a spinner and asks for nothing, and invisible "runs challenges completely in the background". We measured managed and invisible; a non-interactive deployment was not among our pages.

How did an agent do in each of the 3 measured variants?

The agent passed all three variants with the same tools it uses for all captcha solving, and the only one that needed a click was the one where Cloudflare itself chose to ask for it. The same browser, the same profile and the same line served all three pages.

5sim and the Cloudflare sign-up page run the same managed mode. On 5sim Turnstile never started an interactive step; on its own sign-up page Cloudflare did. Managed mode decides per request whether it wants a checkbox, so being asked is already the signal that the request looked less certain.

Why do public Turnstile demos prove nothing?

Public Turnstile demos prove nothing about detection because they run on Cloudflare's test keys, which answer the same way for every visitor. Cloudflare's testing documentation lists 1x00000000000000000000AA as "Always passes" and 3x00000000000000000000FF as "Forces interactive challenge", and every test key returns the token XXXX.DUMMY.TOKEN.XXXX. Cloudflare's own demo page runs on the first key, and a popular captcha demo runs on the second. A production key starts with 0x, so checking the key in the page source takes a second and tells you whether you are measuring detection or your own integration.

What went wrong on the first attempt at the checkbox?

The first click on the checkbox never reached it, and the cause was ours. The page's cookie consent layer covered the screen, the agent's covering test was skipped for nodes inside frames from another process, and the click landed on the consent overlay. A recording inside the challenge frame showed that the checkbox never saw the click. A challenge behind a consent banner is the ordinary layout of the web, not an edge case, and three changes followed:

1. On 5 August the covering test stopped skipping nodes in frames from another process, so a full-screen layer such as that consent overlay is reported instead of clicked blind.
2. On 14 August the test moved to the exact point the click aims at, instead of the centre of the element's box.
3. Also on 14 August, a node that lies completely inside the target's box started to count as part of the target rather than as a cover; a full-screen overlay still counts as a cover.

These changes explain one lost attempt. They do not explain the two runs on 4 August in which the click was accepted and no token came back.

What is still open?

The Cloudflare sign-up page moved from "fails" to "passes" between 4 and 14 August 2026, and we cannot name the cause. In between lie the overlay fix of 5 August, the two fixes of 14 August and ten days of Cloudflare's own scoring of that profile. A control run with ordinary Chrome was planned to explain the failure and became pointless once the failure disappeared. We keep the case on our list of results to repeat rather than filing it as solved.

What should you check before trusting a Turnstile result?

Check the site key first, then measure on production pages with a real exit address, and repeat any single run before you believe it. Look for consent banners and other layers over the widget, because a click that lands on them looks like a failed challenge. The verification page of the documentation keeps the current status of every challenge type we have measured.