Researchers at Vicarious AI have developed a new brain-inspired AI technique that can solve CAPTCHAs with less training data than other AI techniques
One of the ways computers distinguish humans from robots is with CAPTCHAs — that little box with a weird letter combination at the bottom of your online ticket or other transaction.
Context & Ripple Effects
Vicarious AI's result lands just months after Google rolled out invisible reCAPTCHAs that score users on behavior instead of a checkbox — a sign the company already saw text-distortion puzzles as a losing defense. The new technique matters because it attacks the economics of the attack, not just one puzzle type: a model that needs far less training data makes each attempt at breaking a challenge cheaper.
The corpus shows where this leads: by 2019, machine learning had gotten good enough at recognition tasks that Google's own CAPTCHAs were getting too hard for humans to solve, and in 2024 researchers claimed an AI could pass reCAPTCHAv2 with 100% accuracy using roughly human-level attempts. Vicarious is an early data point in that erosion.
First-order effects
- Google's reCAPTCHA team faces a demonstrated bypass method whose low training-data requirement lowers the barrier for attackers to adapt it to new challenge formats.
Second-order effects
- Sites relying on CAPTCHA for ticketing and transactions get pushed toward harder or behavioral challenges — the same escalation that made Google's puzzles harder for legitimate humans by 2019.
Third-order effects
- If challenge-response verification keeps losing to cheap models, human-verification shifts from puzzles users solve to implicit signals platforms infer — a structural move away from user-facing tests entirely.
The trend: Bot-detection is locked in an arms race where each generation of CAPTCHA buys less time against increasingly data-efficient AI, pushing verification toward invisible behavioral signals.