hCaptcha and AI agents: 4 of 4 solved, 0 on its own demo

On 5 August 2026 our agent solved hCaptcha's image task five times in a row on a third-party site, each time with a green checkbox and a token of 2,502 to 2,583 characters, in 30 to 40 seconds per set of two pages. No solving service and no extra model took part. The same chain then answered hCaptcha's own demo correctly, four different task types, and never received a token. Both results are true at once, and the difference between them is the most useful thing we learned about hCaptcha.

What is hCaptcha?

hCaptcha is a challenge service that shows image tasks and returns a token to the site when they are answered. Its developer guide publishes test keys and warns that "the test keys provide no anti-bot protection"; the test site keys begin with 10000000-ffff. The deployment we measured used a production key, and so did hCaptcha's own demo, so neither result is the always-pass behaviour of a test key.

How did the agent solve 4 of 4 sets?

The agent solved the sets by measuring how the picture changes over time, because the task could not be answered by looking at a single frame. The task read "please click on the growing shape": four stars pulse, and exactly one of them grows. Two photos of a star 10 percent apart in size cannot be compared by eye, and each look cost a tool round trip of 20 to 30 seconds against a window of about two minutes.

The chain that worked takes three calls:

1. screenshot records a series of the task image in one call, 20 frames at 300 milliseconds.
2. measure_frames returns every figure with its position as a fraction of the image, its area per frame, its growth and how steadily it grew. In one run the leading figure grew by a factor of 1.94 with a correlation of 0.99.
3. click lands on that fraction of the image through the same input layer that moves every other pointer.

The first five runs used the measuring as a script next to the agent; the four after that ran every step through the agent's own tools, once measure_frames had moved into the product the same day. We report both rows, because only the second meets our own rule for verification challenges for agents: a solved challenge goes through the agent's tools alone.

Which measuring mistakes did we make first?

We made three measuring mistakes before the chain worked, and each one produced a confident wrong answer:

1. A global brightness threshold. The background drifts, and a star over a darker patch merges with it: one figure measured 4,197 pixels in one frame and 15,223 in the next without changing.
2. A blur smaller than the largest figure. The large star then counts as its own background, and what remains is its outline; once a figure broke into 8 fragments.
3. Comparing the first frame with the last. The animation loops: the growing shape jumps back to zero at its maximum, and the shrinking ones do too. Compared first against last, the verdict comes out reversed, and the agent once clicked the wrong star.

Why did hCaptcha's own demo refuse the same answers?

hCaptcha's own demo refused the answers because the demo's key, not the browser, set the outcome. On its demo page the same chain met four task types, answered each correctly and checked each answer against a screenshot, and it submitted the sets complete and in time. It never received a token. The browser, the profile and the line were the same as for the third-party site that returned 5 tokens out of 5, and the answers went out in the same minute. The settings sit with the site key, so a refusal on one key is a statement about that key and not about the browser.

Two limits turned up along the way. After about 20 checks in 20 minutes from the same address, the widget stops loading images and stays on its spinner. And a challenge left untouched closes itself after roughly two minutes: one opened at 15:38:02 was still open at 15:39:58 and gone at 15:40:28.

How does reCAPTCHA compare?

reCAPTCHA's image grid is answered the same way, by reading the tiles from a screenshot, and it needs no frame series because its pictures do not move. On Google's own demo the puzzle opened for our browser and for ordinary Chrome alike, so there the puzzle says nothing about detection. The invisible version is a separate case, covered in reCAPTCHA v3 for agents: no puzzle, only a score.

What should you take from this for your own agent?

Measure moving challenges instead of looking at them, and check what kind of key a page uses before you draw conclusions. A result on one deployment is a result for that key and that frame layout: our chain worked on pages that keep hCaptcha in a frame of the same process, and a page that put it into a frame of its own process was unusable until our click check learned to run inside that frame on 20 August. The verification page of the documentation lists the measuring tools and the current status per challenge type.