Zero-shot, zero-cost models crack Google reCAPTCHA

Problem

This paper studies whether free, locally run vision-language models can reliably solve Google reCAPTCHA visual challenges without training or paid APIs, and what that implies for the continued viability of challenge-based CAPTCHAs. It matters because reCAPTCHA protects many sites from automated abuse, but rising accessible AI may invalidate the assumption that image-recognition tasks remain bot-hard while remaining human-easy.

Approach

The authors collected 1,000 real-world reCAPTCHA challenges (662 Type A, 338 Type B) using a Selenium-based crawler and labelled them by hand for offline evaluation. They categorised reCAPTCHA visual tasks into two types: Type A is a 3×3 grid of independent image tiles (static or dynamic); Type B is a single photograph partitioned into a 4×4 tile grid. Two zero-shot, open-source local models were selected without fine-tuning: CLIP for per-tile classification on Type A and OWLv2 for open-vocabulary object localisation on Type B. They built an end-to-end automated solver that navigates reCAPTCHA iframes, extracts the keyword and tiles, classifies or detects, maps detections to tiles, simulates human-like interactions, and iterates until success or a 20-attempt limit. They also implemented a prompt-only solver realised as a natural-language "skill" invoked via a commodity AI assistant to classify tiles without any code or local models, evaluating its cost and latency when run on a paid multimodal service.

Key Findings

• Zero-shot local models break reCAPTCHA at scale: CLIP achieves 58.0% per-challenge accuracy on Type A, OWLv2 achieves 43.5% on Type B, all with no training, no predefined class list and no API cost.
• High end-to-end success: an automated pipeline using these models achieved a 92.6% per-session success rate across 500 live reCAPTCHA sessions (2,931 challenges).
• Type B is the main failure mode: sessions composed entirely of Type A succeeded at 99.5%, while increasing proportions of Type B challenges reduced session success substantially, matching OWLv2's lower offline accuracy.
• Zero-code attack is feasible: a prompt-only skill run via a commercial assistant reached 95.5% offline accuracy on Type A and 50.5% on Type B, but incurred substantial latency and monetary cost (Type A mean 272k tokens, US$0.150 per challenge; Type B mean 616.5k tokens, US$0.268), and high per-challenge latency (Type A mean 38.4s, Type B mean 83.7s, up to 276.9s).
• Local inference is cheap and fast: the deployed CLIP and OWLv2 variants run on a consumer laptop without a dedicated GPU, use a few gigabytes of storage, classify tiles in under one second and incur negligible electricity per challenge (estimated 10–15 J).

Limitations

Experiments deliberately used fresh, unauthenticated browser sessions to avoid reputation-based bypasses, representing a worst-case, low-reputation scenario. The prompt-only solver suffers from high latency and token costs that can cause session timeouts given reCAPTCHA's roughly two-minute session window; successful prompt-only runs may require paid access. Offline per-challenge accuracy is a strict exact-match metric and understates real-world acceptance because reCAPTCHA tolerates some human ambiguity. The authors do not release the full online solver to limit misuse, though the labelled dataset and prompts are public.

Implications

An attacker with commodity hardware and open-source models can defeat visual reCAPTCHA at low or zero monetary cost, and a non-technical attacker can do so using only natural-language instructions to an AI assistant, collapsing the attacker skill floor. This transforms the threat model for sites that rely on visual challenge fallbacks and suggests that challenge-based visual CAPTCHAs are no longer a robust defence against automated abuse.