AI agents now defeat most bot detection systems, new benchmark finds
Benchmarking Bot Detection Systems Against Modern AI Agents in 2026
A 2026 benchmark tested five bot detection systems against scripted browsers, stealth browsers, and AI agents. Proof of Human caught 99% of automated sessions, but Cloudflare Bot Management caught only 9.1%. hCaptcha and Turnstile stopped scripted browsers yet failed against vision-capable agents that solved image challenges; reCAPTCHA v3 caught most agents but missed the stealth browser. The results suggest behavioral signals are becoming essential.
Interactive challenges may offer limited protection when vision-capable agents can interpret and complete them.
- asksomeoneelse
I don't want to say "that's an ad", but I can see an obvious conflict of interest there.
Also, the methodology just compare the true-negative detection rate for known negative, it seems?
> "Proof of Human identified 99% of automated sessions"
> "We measured detection rates for automated sessions but did not evaluate false-positive rates among human respondents."
Trivially easy measure to game if so. "isHuman(x) = return false" gets you a 100%.
- aurareturn
When they run these benchmarks, they should measure false positives - because it's annoying for a real human to solve a captcha.
If blocking 1 bot request is +1 then making a human solve a captcha should be something like -100. That's how we should grade.
- mimimile
While building a project, I needed a crawler to read robots.txt. Out of 10,000 sites, just over 1,200 refused access outright.