When did the internet stop being a space primarily for people? Anyone who has tried to buy concert tickets lately has likely noticed a shift. The security checks that pop up \u2014 “select all crosswalks,” “click the image containing a bicycle” \u2014 have become more frequent and more frustrating. It is not just a change in web design. It is a symptom of a fundamental transformation now confirmed by hard data: for the first time, automated programs, not human beings, make up the majority of all internet traffic.<\/p>\n
The 2026 annual Bad Bot Report from Imperva<\/a>, part of the Thales Group, provides the numbers. The report, covering the full year of 2025, found that bots now account for 53 percent of all internet traffic. Human activity has dropped to 47 percent. Malicious bots alone represent 40 percent of total traffic \u2014 up three percentage points from 37 percent in 2024 and marking the seventh consecutive year of increase.<\/p>\n Behind this steady climb lies the rapid evolution of artificial intelligence. The report documented a staggering 12.5-fold increase in AI-driven bot attacks compared to the previous year. The daily volume of blocked bot attacks jumped from 2 million to 25 million. A new category, labeled “AI Agents<\/a>,” further complicates the picture. These autonomous bots are embedded directly into search platforms and browsers, accessing websites and APIs in ways that are increasingly difficult to distinguish from legitimate human users.<\/p>\n The message from the data is clear. The internet is no longer a human-first environment. Automation has taken the majority share. The question is what that means for authentication, security, and the ordinary experience of going online.<\/p>\n The CAPTCHA \u2014 which stands for Completely Automated Public Turing test to tell Computers and Humans Apart \u2014 was designed on a now-fragile assumption: that humans could easily solve a puzzle that machines could not. The visual challenges, the distorted text, the image grids were all built on that premise.<\/p>\n That premise is no longer valid. In September 2024, a research team led by Andreas Plesner at ETH Zurich<\/a> published findings that shook the authentication industry. By modifying the YOLO object recognition model, their system achieved a 100 percent<\/a> success rate against Google’s reCAPTCHA v2 \u2014 the widely used “select the traffic lights” type of challenge. Previous AI models had maxed out at 68 to 71 percent accuracy. The ETH Zurich model not only achieved perfect accuracy but required no more attempts than a human would.<\/p>\n Broader comparisons reveal the scale of the reversal. AI models now achieve between 96 and 100 percent accuracy on image-based CAPTCHA tests. Humans, by contrast, typically fall between 50 and 85 percent. The speed gap is even more dramatic. Humans take an average of 9 to 15 seconds to solve a challenge. AI completes the same task in under one second. The technology designed to separate people from bots has become a test that machines pass faster and more accurately than the people they were supposed to protect.<\/p>\n The harder the puzzles become, the more humans struggle. Bots keep breaking through. The wall that was built to let people in and keep machines out now does the opposite: it blocks legitimate users while automated systems slip past.<\/p>\n AI-driven breakthroughs are not the only threat to CAPTCHA. A lower-tech but stubbornly resilient industry known as “CAPTCHA farming” continues to operate at scale. The mechanism is straightforward: when a bot encounters a CAPTCHA, it forwards the image via API to an external worker, who solves it for a tiny fee. Rates run as low as 1 to 3 dollars per 1,000 solved CAPTCHAs. Workers in the Philippines, India, Bangladesh, and other countries spend hours each day solving these puzzles.<\/p>\n The irony cuts deep. A system built to prove that a user is a human being has given rise to an industry that exploits human labor at extremely low wages. The authentication mechanism originally designed to separate humans from bots now relies on humans being paid starvation wages to authenticate bots.<\/p>\nHow CAPTCHA Became a Test Humans Fail More Often Than Machines<\/h2>\n
The Persistence of Human-Labor CAPTCHA Farms<\/h2>\n
The Move to Invisible Authentication<\/h2>\n