Image and text captchas for AI agents: 2 of 3 read correctly
Can an AI agent read a distorted text captcha itself? 5 image and text challenges measured on 14 August 2026, the one miss explained, and no solving service.
Davide Valli · Founder, Scalebrowser
Published Nov 13, 2026 · 6 min read
Short answer
Text captchas are the oldest kind of challenge and still sit in front of many contact forms and sign-ups. For a script they used to mean an OCR library or a paid service that forwards the picture to someone who types it. We wanted to know how far an agent gets with the tools it already uses to read a page, so on 14 August 2026 it worked five live widgets, all with production settings and no test keys.
What is an image captcha?
An image captcha is a challenge that puts its question into a picture, so that software without eyes cannot answer it from the page's text. It comes in two kinds. A text-in-image captcha draws characters with distortion, noise and lines through them and asks for the characters; BotDetect and MTCaptcha are two providers that still ship this kind. An image-selection captcha shows a photo or a grid and asks for a click on the right parts, such as icons in a given order.
Both kinds assume the same thing: a machine can read the page's markup but not the picture. That assumption held while reading a picture meant training a model for one captcha style. A multimodal agent reads pictures the way it reads text.
Can an AI agent read a distorted text captcha?
Yes. On BotDetect's own demo the agent typed the right characters in 2 of 3 runs, and on a second provider and on MTCaptcha it passed at the first attempt. All runs were on 14 August 2026, through the agent's ordinary tools, and a run counted only when the widget or the page confirmed it.
| Challenge | Measured on | Result | Attempts |
|---|---|---|---|
| Text in an image, BotDetect | captcha.com demo | correct | 2 of 3 runs |
| Text in an image, second provider | 2captcha demo | correct | first attempt |
| MTCaptcha | 2captcha demo, MTCaptcha widget | "captcha verified successfully" while typing | first attempt |
| A question in words, no image | 2captcha demo | correct | first attempt |
| Icons in order in a photo | 2captcha demo | "Captcha is passed successfully!" | first attempt |
Three of the rows rest on one run each, and one run is an observation, not a proof. The BotDetect row is the only one with repeats, and its failure is the instructive one. The question in words ("If tomorrow is Saturday, what day is today?") needed no image at all: the question stood in the page's text, which the agent reads anyway.
Why did one BotDetect run fail?
The failed BotDetect run was a reading error: the agent misread the code, the flow itself worked, and the widget rejected the answer. BotDetect draws its codes in styles that run circles, chalkboard strokes and thick and thin lines through the characters, which is exactly the part a reader can get wrong. A second trap sat in our own measuring. A check for the word "Correct" on the result page reported success on a page that said "Incorrect!", because the one word contains the other. The picture of the result is the evidence, a text match is not.
How does an agent solve an image captcha without a service?
An agent solves an image captcha without a service by treating it as what it is, a picture on the page. The steps are the same for every provider we measured:
- Capture the element. A screenshot of the captcha element alone, not the whole page, so the characters are large enough to read.
- Read it. The agent's own model, the one that reads the rest of the page, reads the characters or finds the icons; no solving service sees the picture.
- Answer through the input layer. The characters are typed at the profile's own cadence, and icon clicks travel as pointer movement, so the answer arrives as a person's input would.
This is how the 18 challenge types in our series were solved without a solving service, and for text it is the shortest of all: one screenshot, one reading, one typed line. The free path does the same work with other parts. An OCR library such as Tesseract needs the picture cleaned first; its own documentation warns that "certain types of noise cannot be removed by Tesseract in the binarisation step", and adding noise is what a text captcha does. A solving service returns the text from a person or a model somewhere else, for a fee per solved captcha and with the picture sent out of your hands. The verification documentation lists the tools behind each step and the challenges each one was measured on. The rotation captcha, an image task the agent did not pass, is covered in Rotate captcha.
Why do text captchas no longer separate people from machines?
Text captchas no longer separate people from machines because machines have read them reliably for more than ten years. The research record is short and one-sided.
| Year | Who | Finding |
|---|---|---|
| 2013 | Goodfellow, Bulatov, Ibarz, Arnoud, Shet, Google | "a 99.8% accuracy on the hardest category of reCAPTCHA" with a network trained on Street View house numbers |
| 2016 | Sivakorn, Polakis, Keromytis, Columbia University | reCAPTCHA's text puzzles were being phased out, with image captchas as the default |
| 2026 | Scalebrowser | 2 of 3 on BotDetect, first attempt on two more providers, with a general-purpose agent |
The Google paper came from inside the company that ran reCAPTCHA, and by 2016 its text puzzles had largely given way to images, as the Columbia paper observed. MTCaptcha, one of the providers still drawing text, now sells mostly the part around the picture. Its site sells an "adaptive risk engine" that "continuously reads the threat environment and adjusts difficulty", names a "99.5% human first-pass" rate and says "most visitors pass without lifting a finger". In that design the picture is only what a visitor sees once the risk check has already doubted them.
What should you expect from a text captcha on a real site?
Expect the picture to be the easy part and the site's configuration to decide the rest. A widget that shows a harder style after a miss, or that scores the visitor before it shows anything, will treat two agents with the same reading skill differently. Judge a run by the page's own answer, repeat it before you trust it, and read the picture again after a rejection rather than resubmitting the same text. BotDetect's demo also offers the code as sound, but switching to audio when the picture is readable is itself a pattern a site can notice, so it is the second door, not the first.