Summary: Browserbase’s Kanika Pandey and Benjamin Krejci argue that visual CAPTCHAs are collapsing as AI agents learn to solve them, and that the real problem is shifting from “is this a human?” to “who operates this agent, and is it allowed here?” For builders shipping browser agents, that means planning for agent identity and access rather than relying on puzzles to keep bots out.
The puzzles no longer work
CAPTCHAs were built on one assumption: some tasks are easy for humans and hard for machines. That assumption has eroded. According to the Browserbase post, a system called Halligan presented at USENIX Security 2025 solved 60.7% of 2,600 visual challenges across 26 CAPTCHA types. In September 2026, two further studies reported 92.6% success on 500 real-world reCAPTCHA sessions using free, locally running models, and 85.4% accuracy across 16 challenge classes.
The studies aren’t directly comparable, and they don’t prove every CAPTCHA is beatable. But the trend line matters: the puzzles designed to keep machines out are increasingly solvable by machines, sometimes without expensive frontier models.
The problem behind the problem
Detection has already been moving past visual challenges for a while. Cloudflare Turnstile runs background browser checks, and Google reCAPTCHA supports risk-based assessments that skip the visible test. Browserbase also points to Web Bot Auth, which lets trusted agents prove who they are so sites can admit them while still blocking abusive bots — an idea we covered in Cloudflare Verified Bots: Trust Now Depends on Behavior.
But identity alone doesn’t settle access. The post cites September 2026 reports that Amazon blocked Meta’s Muse AI agent from shopping on its site. That wasn’t a CAPTCHA failure; it was an authorization question. A customer may want the agent there, the agent may be fully capable of navigating the checkout — and the site owner may simply not permit it.
Three separate questions for builders
Browserbase frames agent interactions as three distinct checks, using a flight-booking example:
- Human identity: who is the customer?
- Agent identity: which software is making the request?
- Authorization: has the customer permitted the agent to act?
These can’t be collapsed into one. An agent with a valid cryptographic signature hasn’t proven its human authorized a $1,000 purchase. Protocols like Web Bot Auth handle identity; OAuth-style delegation and emerging agent-identity work handle permissions; sensitive transactions may still need explicit human approval.
Where Browserbase fits
The post lays out two coexisting futures. If sites adopt agent-specific authentication, Browserbase wants to be the trusted access layer holding those keys between agents and websites. Meanwhile, a large part of the web — legacy systems, complex interfaces, services without agent-friendly APIs — will never implement agentic access, and browser infrastructure for those sites remains necessary. Browserbase already lets agents toggle verified mode at session creation:
import Browserbase from "@browserbasehq/sdk";
const bb = new Browserbase({ apiKey: process.env.BROWSERBASE_API_KEY });
const session = await bb.sessions.create({
browserSettings: { verified: true, os: "mac" },
proxies: true,
});What to take away
Visual CAPTCHAs won’t vanish overnight, but they’ll matter less as agents solve them and as legitimate agents gain ways to identify themselves. The durable problems are fraud, spam, scraping, and unauthorized access — and an identified agent isn’t automatically a trustworthy one. If you’re building agents, the practical step is to design for the identity-authorization split now rather than treating a solved CAPTCHA as proof you’re welcome.