Benchmarking Bot Detection Systems Against Modern AI Agents in 2026

This benchmark re-evaluated five bot-detection systems - Proof of Human, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, and Cloudflare Bot Management - against five adversaries: a baseline automated Chromium, a stealth-modified CloakBrowser, and three LLM-driven browsing agents (Browser Use with Claude Opus, Perplexity Comet, and xAI’s Grok). Each adversary attempted a five-question mixed survey up to 20 times, producing roughly 89-100 sessions per system. Aggregate detection rates varied widely: Proof of Human flagged 99% of automated sessions, reCAPTCHA v3 69.4%, hCaptcha 44.3%, Turnstile 42.1%, and Cloudflare Bot Management 9.1%. The study links higher performance to systems that combine behavioral and device signals.

Performance patterns expose where current defenses break down: hCaptcha and Turnstile reliably stopped scripted Chromium and CloakBrowser but failed against vision-capable agents that could solve image challenges; reCAPTCHA v3 caught most LLM agents but missed CloakBrowser, implicating source-level fingerprint modifications and residential IPs; Cloudflare Bot Management flagged few sessions overall. Limitations include differing sample sizes, use of non-enterprise tiers, and no human false-positive measurement. The findings argue that traditional browser-level signals still catch obvious automation, but AI agents that operate in genuine browsing environments undermine puzzle- and fingerprint-based defenses, shifting the arms race toward richer session-behavior analysis and larger, human-calibrated benchmarks.