AI is making traditional CAPTCHA tests easier for bots to solve, forcing websites to find other ways to identify suspicious traffic, The Wall Street Journal reports.
A Sept. 16 paper titled “Robot Visions: Breaking reCAPTCHA at Zero Cost and Zero Shot” found that an automated solver built with free, locally run AI models passed 463 of 500 real-world reCAPTCHA sessions.
That produced a 92.6% per-session success rate, despite the system requiring no model training or paid API access.
The researchers used open-source CLIP and OWLv2 models, which recorded individual challenge accuracy rates of 58% and 43.5%, respectively.
Multiple attempts within a reCAPTCHA session helped push the end-to-end success rate substantially higher.
The problem extends beyond whether AI can identify a traffic light.
CAPTCHA appears across forms, account creation, logins, and checkout.
Those are also the interactions where UI/UX design agencies and conversion rate optimization agencies work to remove unnecessary friction and keep users moving toward a conversion.
Ken Braun, co-founder and chief brandtender of Lounge Lizard, says those goals can no longer be separated from website security.
“Security can’t be treated as something you add after the customer journey has already been designed,” Braun says.
“If your protection stops bots but also creates unnecessary steps for legitimate customers, you’ve solved one problem by creating another.”
AI Is Breaking the CAPTCHA Model
The shift away from visible CAPTCHA challenges is already underway.
Google’s reCAPTCHA v3 uses a score-based system to evaluate user interactions without interrupting every visitor with a challenge.
Google recommends using those scores to respond according to risk. A suspicious login, for example, can trigger two-factor authentication or email verification instead of an automated block.
Cloudflare Turnstile follows the same basic principle.
It checks signals from the visitor’s browser and can run challenges in the background, without presenting the visual puzzles associated with traditional CAPTCHA.
Managed Turnstile only asks for interaction when it detects potentially automated traffic, while its invisible mode runs without visitor interaction.
In July, Cloudflare expanded that approach with Precursor, which monitors client-side behavior across a browsing session.
The scale of automated traffic makes that shift increasingly important.
Cloudflare said in July that bots now generate roughly 57% of all web requests, and it’s the first time that automated traffic has exceeded human activity across its measurements.
Its Precursor announcement tied that growth to the need for behavioral defenses that do not depend on disruptive checkpoints.
That also changes the role of cybersecurity companies working with brands on website protection.
“The old approach was largely about stopping the visitor at a checkpoint and asking them to prove they were human,” Braun says.
“Brands now have much more context available. They can look at the behavior, assess the level of risk, and apply stronger verification when the action actually justifies it.”
That also means the level of protection can depend on what the visitor is trying to do.
Google itself recommends applying reCAPTCHA scoring to sensitive actions including registrations, purchases, and password resets, then selecting the appropriate response based on the score.
“Brands should identify where automated abuse would actually hurt the business most and put stronger controls around those moments,” Braun adds.
“Most genuine visitors shouldn’t have to work harder because somebody else might be a bot.”
Can Stronger Security Hurt Conversion?
The question is how much bot protection a site can add before it starts getting in the way of leads and sales.
Baymard Institute’s 2026 cart abandonment research found that 17% of U.S. online shoppers had abandoned an order because the checkout process was too long or complicated.
Another 17% cited website errors or crashes.
And while those figures aren’t specific to CAPTCHA, they do show how sensitive high-intent visitors can be to added friction.
DesignRush’s own guide to eCommerce checkout best practices points to unnecessary form fields, additional steps, and other obstacles as reasons shoppers abandon checkout.
It found that sites can remove 20% to 60% of visible checkout form elements without taking out necessary information.
Adding an unnecessary security challenge at the same stage works against that goal.
“If you only measure how much automated traffic a control blocks, you don’t know whether it is working for the business,” Braun says.
“You also need to look at legitimate form completions, checkout abandonment, false positives, and conversion before and after those controls are introduced.”
That means security changes should be evaluated alongside other website and conversion changes.
Challenge rates, failed verifications, form completion, checkout abandonment, and conversion can reveal whether a safeguard is stopping abuse without creating a new barrier for customers.
The Wall Street Journal’s reporting shows why that balance is becoming more important.
Bots are improving at solving visible CAPTCHA challenges while websites are shifting toward quieter forms of behavioral detection.
And the latest reCAPTCHA research suggests visual challenges are becoming an increasingly weak fallback as accessible AI systems improve.
For brands, adding more puzzles for humans is unlikely to solve a problem increasingly created by machines.
Website protection and conversion-focused UX now need to be designed as part of the same customer journey.
