Benchmark: hCaptcha, Turnstile miss AI agents, catch bots

Proof of Human published a benchmark on October 25, 2026, comparing five bot detection systems and finding that hCaptcha and Cloudflare Turnstile largely fail to catch AI agents while still stopping scripted bots. The test, reported by gigazine.net, covered Proof of Human, reCAPTCHA v3, hCaptcha, Cloudflare Turnstile and Cloudflare Bot Management.

The setup used three AI agents — Browser Use running Claude Opus, Perplexity's Comet and xAI's Grok — plus two scripted bots, one built on Chromium and one on CloakBrowser, which hides automation traces and used an IP address on a residential connection. Each system was tested 20 times per agent or bot, and the detection rate was the share of evaluated trials in which the automation was caught.

Diverging results

hCaptcha and Cloudflare Turnstile detected the scripted bots at 95-100%, but their results against the AI agents were weak. hCaptcha's detection rate was 16% for Browser Use, 0% for Comet and 6% for Grok. Cloudflare Turnstile recorded 0% for all three AI agents and passed them without presenting a challenge. The AI agents reportedly solved hCaptcha's image challenges in many trials, while the scripted bots often failed them.

reCAPTCHA v3 moved in the opposite direction on agents: it detected Browser Use at 95%, Comet at 100% and Grok at 72%. Its detection rate for the CloakBrowser-based automation was 0%.

Across all AI agent and bot trials combined, Proof of Human had the highest detection rate at 99%, followed by reCAPTCHA v3 at 69.4%. The study did not measure how often the systems falsely flag humans as bots, and the team said future work should include human participants.