AI achieves a 100% success rate beating Google CAPTCHAs

There is nothing more universally annoying on the internet than squinting at nine grainy squares, trying to decide if the edge of a lamppost counts as a traffic light, just to prove you have a soul.

Now, machines have officially solved the test meant to keep them out.

Researchers at ETH Zurich led by Andreas Plesner took the popular computer vision model YOLO (You Only Look Once) and fine-tuned it specifically to tackle Google's reCAPTCHAv2. The result was a clean 100 percent solve rate across their tests.

The traffic light trap

Turns out, CAPTCHA's own design made it an easy target. Plesner pointed out that reCAPTCHAv2 is painfully predictable. It tests across a very narrow slice of the world, focusing on around 13 specific road-based objects like crosswalks, traffic lights, buses, cars, and bicycles.

The team fed roughly 14,000 labeled image pairs into YOLO, training it on exactly what those street scenes look like.

Passing Google's challenge involves more than just clicking the right box, though. The system also tracks device fingerprinting, quietly checking browser history, cookies, and human-like mouse movements.

The researchers factored these signals into their setup as well. The AI did not get every single picture right on the first try, but it learned human behavior: when stumped, it rejected confusing puzzles and requested alternatives until it cleared the gate.

In response, Google Cloud noted that image recognition issues are not new, which is why it rolled out reCAPTCHAv2's invisible successor, v3, back in 2018. Google says the majority of its protections across 7 million sites globally operate invisibly without visual prompts.

Yet security experts see a deeper dilemma. Eerke Boiten from De Montfort University noted that as AI matches human sight, verification systems will lean even harder on device fingerprinting, making it increasingly difficult for real people to prove their humanity without handing over device telemetry.

Why it matters

For everyday internet users, this confirms what many already suspected: visual CAPTCHAs are living on borrowed time. Giving users cognitive tests to filter out machines is dead when cheap, fine-tuned vision models can solve them effortlessly.

We think the real concern lies in what replaces them. As front-end visual puzzles fall, defensive platforms will rely heavily on tracking background device fingerprints, browser cookies, and behavioral biometrics. In an ironic twist, keeping bots out of websites will likely cost humans more of their online privacy.

For developers and site owners still leaning on legacy image challenges, the writing is on the wall. Training YOLO on custom targets is accessible to virtually any hobbyist or scraper team. Relying on simple puzzles for bot protection today is little more than security theater.