While puzzling captchas--from dogs in hats to sliding jockstraps--still exist, most bot-deterring challenges have vanished into the background. As I browse the web in 2025, I rarely encounter captchas anymore. There's no slanted text to discern. No image grid of stoplights to identify. And on the rare occasion that I am asked to complete some bot-deterring task, the experience almost always feels surreal.

Kurt "CyberGuy" Knutsson says hackers are using CAPTCHAs to infect your PC with malware. Ransomware gangs once thrived on infected email attachments and bogus invoices, but security-savvy users and hardened mail gateways have weakened those tactics. Attackers are now focusing on a subtler trick that targets the small checkbox labeled "I'm not a robot" that most people click without thinking. A widespread campaign known as MacReaper has compromised more than 2,800 legitimate websites and redirects visitors to an infection process designed specifically for Apple computers. The operation relies on visual trust signals, including a convincing fake of Google's reCAPTCHA, along with hidden clipboard code that ends with the installation of Atomic macOS Stealer malware, a data-harvesting infostealer distributed through Telegram.

For many years, publicly accessible Web applications have been protecting their services from bots and scripts by asking users to solve captchas (Completely Automated Public Turing tests to tell Computers and Humans Apart), puzzles designed to be challenging for machines to solve yet simple for humans, such as clicking on certain locations in an image or recognizing elongated characters or digits. Designed to stop robotic assaults like spamming, data scraping, and brute-force login attempts,1 captchas act as a security precaution to determine whether a user is a human or a software program. Captcha techniques are employed in many different areas, including e-transactions, entering a website's secure areas, gathering email signups, and ensuring that only humans vote when conducting polls and surveys. They are also used to hinder attackers and spammers from injecting malicious software into online registration forms. As such, captchas are also employed as a line of defense against threats such as DDoS attacks, dictionary attacks, malvertising, and botnet and spam attacks.

Some days, I wonder if I'm a bot. The problem is CAPTCHAs, those little online challenges that websites require you to pass to prove that you're a human. When one pops up on my screen, I tend to spend way too much time looking at the grid of nine images and clicking those with a traffic light, or a crosswalk, or a bike … only to miss the one in the bottom-right corner that just barely looks like a bike. Lately, I've had to rotate a 3-D bird to face the same direction a hand is pointing, which should be easy but somehow isn't. CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart," so if I'm flubbing them constantly, then I'm clearly a computer (my wife, house, and cat must all be implanted memories).

Originally published on Towards AI the World's Leading AI and Technology News and Media Company. If you are building an AI-related product or service, we invite you to consider becoming an AI sponsor. At Towards AI, we help scale AI and technology startups. Let us help you unleash your technology to the masses. While OpenAI is famous for its success in NLP and DeepMind is well known for RL and decision making, Tesla is definitely one of the most impactful companies in computer vision.

Like so many this winter, Norine McMahon was searching for a Covid-19 vaccine appointment, hitting Refresh on her browser continuously. The Washington, DC, resident was elated to find an opening in late February, but delight turned to disappointment when she failed the captcha user-verification test, even though she swore she entered the letters and numbers correctly. "Then I would do it really slowly to make sure I was getting it correct, because of course the pressure is on. It happened a dozen times. The captchas weren't working," says McMahon, 61, a facilities director who gave up that day but eventually secured an appointment.

At each identical desk, there is a computer with a person sitting in front of it playing a simple identification game. The game asks the user to complete an assortment of basic recognition tasks, such as choosing which photo out of a series that shows someone smiling or depicts a person with dark hair or wearing glasses. The player must make their decision before moving onto the next picture. Only they don't do it by clicking with their mouse or tapping a touchscreen. Instead, they select the right answer simply by thinking it.

The days of clicking on traffic lights to prove you are not a robot could be ending after Google's decision to charge for the tool prompted one of the web's biggest infrastructure firms to ditch it for a competitor. "Captcha" – an awkward acronym for "completely automated public Turing test to tell computers and humans apart" – is used by sites to fight automated abuses of their services. For years, Google's version of the test, branded reCaptcha, has dominated, after it acquired the company that developed it in 2009 and offered the technology for free worldwide. Google's introduction of charges for the service has prompted Cloudflare, a little-known firm that protects around 12% of the internet from bot attacks, to seek an alternative. The company's founder and chief executive, Matthew Prince, said: "It would have added millions of dollars in annual costs just to continue to use reCaptcha for our free users. That was finally enough of an impetus for us to look for a better alternative."

If you've ever signed up for anything online, you've probably taken a CAPTCHA test, an automated test to distinguish humans from machines. Click on all the images that contain a stop sign, check the boxes that show cats. But as Jacob Goldstein from our Planet Money podcast reports, the designers of the test have a problem. Machines are getting so smart that they'll soon be better than humans at passing the test. JACOB GOLDSTEIN, BYLINE: The most popular version of the I-am-not-a-robot test is made by Google. And the engineer who runs Google's reCAPTCHA team is named Aaron Malenfant One day a few years ago, he was telling his boss about all the things his team was trying to do to stay ahead of the machines.

We're going to look now at the state of artificial intelligence this month in All Tech Considered. You've probably seen that statement online alongside a prompt that says something like, type the letters you see, or, click on all the stoplights. Do it right, and you get to go on to the next page. These games are developed by Google. Researcher Jason Polakis of the University of Illinois at Chicago has proven that, in fact, robots are pretty good at CAPTCHAs.