You’ve clicked the bicycles. You’ve hunted for traffic lights. You’ve wondered whether a sliver of bicycle counts. Now bots can play too. Yet the puzzles haven’t vanished, Jackie Snow reports in Monday’s Journal Report, and AI is now changing both sides of the fight between websites and bots.
Bots learned the puzzles
Websites need to tell people from bots, which can crash sites and run up costs. That job keeps growing. Cloudflare (NET), which supplies bot-detection tools to millions of websites, says bots overtook humans on its network in June, generating 57% of the traffic it sees.
The captcha — Completely Automated Public Turing test to tell Computers and Humans Apart — was the fix. Then AI learned the grids. Yun Lin, a researcher at Shanghai Jiao Tong University, built an agent that solved captchas in 70% of attempts with no special training.
So sites now score visitors silently: how the cursor moves, how you scroll and type, whether your IP address has a suspicious history, even your device. Bots are trying to fake human wobble, too. They haven’t fooled the detectors yet, says Cloudflare’s Brian Becker, a director of product, but they’re getting closer.
Why you still see them
Cloudflare’s data show people are slightly less likely to face a visible captcha than a year ago. The grids tend to show up when a system finds you suspicious, or on sites that haven’t upgraded. VPNs, proxies and public Wi-Fi can raise the odds, says Yang Xiang of Swinburne University of Technology in Melbourne, Australia. Many users share one address, and other people’s activity can taint it.
Logging into a bank or credit-card site from overseas tends to trigger more challenges, too, says Gene Tsudik of the University of California, Irvine. He noticed a clear drop after switching from an Android phone to an iPhone, which he attributes to the ecosystem of Apple (AAPL) reading as more trustworthy. That half-a-bicycle square? It’s unlikely to be why anyone gets flagged, he says.
Google, a unit of Alphabet (GOOGL), increasingly asks suspicious visitors to scan a QR code with a phone. A human in the loop makes attacks uneconomical at scale, says Google Cloud’s Abhishek Hemrajani. Still, neither Google nor Cloudflare calls today’s tools permanent. “These technologies last about 12 months,” Becker says. The next question may be less whether you’re a bot than whether you mean well.