OpenAI's ChatGPT Agent casually clicks through "I am not a robot" verification

Original Article ↗ Hacker News Discussion ↗

Economics of CAPTCHAs and Bot Solving

  • Commenters note that human CAPTCHA-solving services are extremely cheap and long-established, now often augmented with AI targeted at specific CAPTCHA types.
  • CAPTCHAs are seen less as an absolute barrier and more as a way to raise the cost of abuse; attackers can still outsource solving at scale.
  • Some argue ChatGPT-style solving is economically irrational today (more expensive than human services) but becomes “free” once you’re already using an agent.

Why Sites Care About “Non‑Human” Traffic

  • Main concerns listed:
    • Mass spam and content flooding (e.g., Viagra spam, misinformation).
    • Abuse of expensive or strategic APIs (flight search, commerce catalogs).
    • One-way scraping of valuable datasets (registries, wikis, user uploads).
    • Operational risk (DDoS-like scraping knocking small sites offline).

CAPTCHAs, Usability, and Discrimination

  • Many describe modern CAPTCHAs (especially Google/Cloudflare) as “cognitively abusive,” buggy, or endless loops, leading users to abandon sites.
  • Blind and disabled users are particularly harmed; audio CAPTCHAs are often easier for bots than humans, so accessibility gets deprioritized.
  • VPNs, Firefox/Linux, anti-tracking, or “unusual” fingerprints sharply increase CAPTCHA frequency, effectively punishing privacy-conscious users.

Agents as User Proxies vs. Site Defenses

  • Strong split:
    • One side: if an agent runs in the user’s browser/device, it is the user; blocking it is akin to controlling the endpoint.
    • The other: site operators must protect resources, ad revenue, and competitive data; they see “mobs of bots” as existential.
  • Suggested successor models: official APIs/MCP endpoints, rate limiting, proof-of-work, or micropayments—though working micropayments are seen as unsolved.

Future: Identity, Paywalls, and Human Verification

  • Many predict a shift to logged-in, paywalled, or app-only experiences, with CAPTCHAs gradually replaced by stronger identity proofs.
  • Proposals include government PKI, iris/biometric schemes, “human tokens” or privacy-preserving ZK proofs; others warn this sacrifices anonymity and enables abuse.
  • Several think the real “ultimate CAPTCHA” will be legal and economic structures (DMCA, regulation, Real ID bans) rather than purely technical puzzles.