2026年对抗现代 AI Agent：主流 Bot 机器人检测系统基准评测
英文标题：🔶 Benchmarking Bot Detection Systems Against Modern AI Agents in 2026
Proof of Human 团队对主流机器人检测系统（包括 Google reCAPTCHA v3、hCaptcha、Cloudflare Turnstile、Cloudflare Bot Management 及 Proof of Human）进行了全新基准测试，评估其对抗传统脚本浏览器、隐形浏览器以及配备视觉的多款现代 AI Agent（如 Browser Use、Perplexity Comet、Grok）的效果。评测结果显示各系统拦截能力悬殊：Proof of Human 综合检测率达 99%，reCAPTCHA v3 为 69.4%，而 hCaptcha、Turnstile 与 Cloudflare Bot Management 仅为 44.3%、42.1% 和 9.1%。研究发现，现代具备多模态视觉的 AI Agent 能轻松突破传统图形验证码并在无感知检测中被放行，表明仅依赖设备指纹与静态验证码的防护机制已显疲态，全会话动态行为分析正成为安全防御的关键。
281.3 KB
353.3 KB
353.3 KB
中文
一年前，我们评估了五款主流 Bot 检测系统（Proof of Human、Google reCAPTCHA v3、hCaptcha、Fingerprint Pro 和 Cloudflare Turnstile）在面对按预设任务编写的自动化浏览器时的表现。当时的检测率差异显著，介于 33% 到 87% 之间。相比仅依赖设备信息的系统，那些将行为信号与设备级信号相结合的系统通常表现更佳。
自那以后，浏览器自动化技术取得了长足进步。现代 AI Agent 能够理解网页、规划操作，并通过能力日益增强的浏览器环境与界面进行交互。因此，我们扩展了对抗测试对象，重新进行了基准评测，测试对象包括传统浏览器自动化、隐形浏览器（Stealth Browsers）以及 AI 驱动的浏览 Agent，并测试了一组类似的检测系统：Proof of Human、Google reCAPTCHA v3、hCaptcha、Cloudflare Turnstile 以及 Cloudflare Bot Management。结果同样显示出巨大的检测性能差距。
在本文中，我们将深入探讨各系统的表现、失效场景，以及这些测试结果对于在日益强大的 AI Agent 面前区分人类所带来的挑战意味着什么。
测试方法
我们的测试任务采用了一份包含五道题的问卷调查，由多选题与开放式简答题组成。五个对抗测试对象（即 AI Agent）各自尝试填写问卷 20 次，每个检测系统最多生成 100 个会话。部分检测系统在会话完成前发生故障或崩溃，因此每个系统最终留下了 89 到 100 个可评估会话。
下表汇总了本次基准测试涵盖的检测系统，以及各系统用于识别自动化行为的信号类型。
| 检测系统 | 说明 |
|---|---|
| Proof of Human | 基于行为和设备信号（包括打字、鼠标移动、点击和滚动），利用机器学习模型将会话分类为人类或自动化行为。 |
| Google reCAPTCHA v3 | 为每个会话赋予 0 到 1 的评分，指示用户为人类的概率。它在无感知（无可见验证挑战）下运行，综合考量浏览器完整性与 Google 端声誉信号；由网站自行设定准入阈值。 |
| hCaptcha | 展示“我是人类”复选框并评估浏览器的风险画像。根据结果，它会立即验证会话，或者要求完成基于图像的验证挑战。 |
| Cloudflare Turnstile | 在后台执行浏览器完整性检查，并在会话通过后发放验证令牌。通常无需拼图交互，但信号模棱两可时可能会请求用户交互。 |
| Cloudflare Bot Management | 利用基于 Cloudflare 整个网络流量训练的启发式算法和机器学习模型评估请求。尽管完整版系统提供 1（自动化）到 99（人类）的分数，但 Pro 级别的实现返回的是更广泛的分类，例如 likely_human、likely_automated、automated 或 verified_bot。 |
我们的对抗测试集涵盖了越来越复杂的自动化形式：传统脚本浏览器、旨在隐藏自动化信号的隐形浏览器，以及能够自主浏览网页并完成任务的 AI Agent。
| 对抗对象 | 说明 |
|---|---|
| Chromium | 通过 Playwright 和 Chrome DevTools Protocol（CDP）驱动的标准 Chromium 浏览器，未做任何隐形化修改。它保留了常见的自动化指标（如 navigator.webdriver 及 CDP 相关痕迹），作为基准“明显 Bot”。 |
| CloakBrowser | 一款专注于隐形对抗的 Chromium 分支，从源码级别修改了浏览器指纹，包括 GPU、Canvas、WebGL、音频、字体、User-Agent 和 TLS 信号。我们通过住宅代理运行它，并启用了其可选的鼠标和键盘输入拟人化功能。 |
| Browser Use | 一款开源 AI Agent 框架，利用大语言模型（在我们的测试环境中为 Claude Opus）和网页视觉信息来规划操作，并从云端基础设施中操作未经修改的浏览器。 |
| Perplexity Comet Uses | Perplexity 的 AI 驱动浏览器，利用大语言模型和视觉信息在网页中导航并完成任务。 |
| Grok | xAI 的浏览器操作 Agent，利用大语言模型和视觉信息进行网页导航并完成任务。 |
结果
我们发现，不同系统之间的检测性能存在巨大差异。综合所有对抗对象来看，Proof of Human 识别出了 99% 的自动化会话，其次是 reCAPTCHA v3（69.4%）、hCaptcha（44.3%）、Cloudflare Turnstile（42.1%）以及 Cloudflare Bot Management（9.1%）。
图 1： Bot 基准评测结果。每个柱状图显示了对应检测系统在所有五个对抗对象中识别出的自动化会话综合百分比。
面对不同的对抗对象，检测系统的表现差异非常大。最明显的分水岭出现在传统脚本浏览器与 AI Agent 之间。hCaptcha 和 Cloudflare Turnstile 几乎捕获了所有脚本驱动的 Chromium 和 CloakBrowser 会话，但对 AI Agent 会话却几乎无能为力。reCAPTCHA v3 则呈现出相反的规律：它识别出了绝大部分 Agent 会话，却未能识别出任何一个 CloakBrowser 会话。Cloudflare Bot Management 针对所有对抗对象捕获的会话都很少，而 Proof of Human 在所有测试中总体检测率均达到至少 95%。
图 2： 各检测系统与对抗测试对象组合下的自动化会话识别百分比。绿色单元格表示被成功拦截的测试对象；红色单元格表示成功绕过检测系统的测试对象。
由于多数检测系统均为黑盒机制，我们无法直接断定具体是哪些信号触发了相应结果。然而，根据观察到的系统行为以及公开的技术文档，可以推断出以下导致检测失效的可能原因：
- reCAPTCHA v3 检测出了标准 Chromium 和云托管 Agent 的绝大部分会话，但未能检测出 CloakBrowser。CloakBrowser 是唯一结合了源码级修改的浏览器指纹与住宅 IP 地址的对抗对象。我们的测试结果无法确定其成功主要归功于浏览器指纹、住宅 IP，还是两者的结合。
- hCaptcha 对 Chromium 和 CloakBrowser 都给出了验证挑战，两者均无法可靠地完成基于图像的任务。相比之下，三款具备视觉能力的 Agent——Browser Use、Grok 和 Perplexity Comet——普遍能够理解并解答图像方格验证码，从而使其绝大多数会话得以顺利通过。
- Cloudflare Turnstile 检测出了两款脚本浏览器对抗对象：Chromium 和 CloakBrowser 即使等待了完整的 30 秒仍未能获得验证令牌。然而，它完全未能检测出这三款 AI Agent 中的任何一个，甚至在这些会话期间根本没有触发验证挑战。
- Cloudflare Bot Management 总体检测出的会话相对较少。这一模式与隐形浏览器和云端 Agent 呈现出干净的浏览器层级信号相吻合，不过对 Grok 相对较高的检测率可能反映了 Cloudflare 所使用的基础设施层信号（如 IP 或 TLS 声誉）。
局限性
在解读这些结果时，需要考量以下几点局限性：
- 部分系统在测试完成前发生崩溃或失败，导致不同测试条件下的样本量略有差异。
- 我们评估的是自身可以获取的产品版本层级，而非可能包含额外信号或更高级检测功能的企业版（Enterprise）。
- 我们测量了针对自动化会话的检测率，但并未评估真实人类受访者的误报率（False-positive rates）。
- 包括 reCAPTCHA 在内的部分系统可能会随着观察到更多流量并建立网站声誉而校准得更好。因此，在长期运行的实际部署中，检测率可能会有所不同。
结论
我们的测试结果表明，Bot 检测正迈入一个新阶段。传统自动化信号在对抗脚本浏览器时依然有效，但在面对能够智能化操作真实浏览器环境的 AI Agent 时却显得力不从心。当具备视觉能力的 Agent 能够自主理解并完成交互式验证时，此类挑战能提供的防护极为有限。随着浏览器层面的特征指标越来越容易被伪造和规避，用户在整个会话期间的行为特征，正日益成为区分人类活动与自动化行为的关键所在。
未来的基准测试应评估更大规模的流量，引入人类参与者以测量误报率，并测试更复杂的任务以及新兴的 Agent。Proof of Human 团队将继续追踪这些变化，并在这个不断演变的威胁格局中开发防御方法。若想在您自己的应用中测试 Proof of Human，请访问 poh.org。
English / 原文
A year ago, we evaluated five leading bot detection systems (Proof of Human, Google reCAPTCHA v3, hCaptcha, Fingerprint Pro, and Cloudflare Turnstile) against automated browsers programmed to complete a set of predefined tasks. Detection rates varied substantially, ranging from 33% to 87%. Systems that incorporated behavioral signals alongside device-level signals generally outperformed those relying on device information alone.
Since then, browser automation has advanced considerably. Modern AI agents can interpret webpages, plan actions, and interact with interfaces through increasingly capable browser environments. We therefore revisited our benchmark with an expanded set of adversaries, including conventional browser automation, stealth browsers, and AI-powered browsing agents, and tested a similar set of detection systems: Proof of Human, Google reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, and Cloudflare Bot Management. The results reveal similarly wide variation in detection performance.
In this post, we examine how each system performed, where it failed, and what these results suggest about the challenges of distinguishing humans from increasingly capable AI agents.
Methodology
Our task used a five-question survey combining multiple-choice items with open-ended responses. Each of the five adversaries (i.e., AI agents) attempted the survey 20 times, yielding up to 100 sessions per detection system. Some detection systems failed or crashed before session completion, leaving between 89 and 100 evaluable sessions for each system.
The table below summarizes the detection systems included in the benchmark and the signals each uses to identify automated activity.
| Detection system | Description |
|---|---|
| Proof of Human | Uses a machine-learning model to classify sessions as human or automated based on both behavioral and device signals, including typing, mouse movements, clicks, and scrolling. |
| Google reCAPTCHA v3 | Assigns each session a score from 0 to 1 indicating the likelihood that the user is human. It operates without a visible challenge and considers browser-integrity and Google-side reputation signals; the site determines the threshold for accepting a session. |
| hCaptcha | Presents an “I am human” checkbox and evaluates the browser's risk profile. Depending on the result, it either verifies the session immediately or presents an image-based challenge that must be completed. |
| Cloudflare Turnstile | Performs browser-integrity checks in the background and issues a verification token when a session passes. It generally operates without a puzzle but may request user interaction when signals are ambiguous. |
| Cloudflare Bot Management | Evaluates requests using heuristics and machine-learning models trained on traffic across Cloudflare's network. Although the full system assigns scores from 1 (automated) to 99 (human), the Pro-tier implementation returns broader classifications such as likely_human, likely_automated, automated, or verified_bot. |
Our set of adversaries covers increasingly sophisticated forms of automation: conventional scripted browsers, stealth browsers designed to conceal automation signals, and AI agents capable of navigating webpages and completing tasks autonomously.
| Adversary | Description |
|---|---|
| Chromium | A standard Chromium browser automated through Playwright and the Chrome DevTools Protocol, without stealth modifications. It retains common indicators of automation, such as navigator.webdriver and CDP-related artifacts, and serves as the baseline “obvious bot.” |
| CloakBrowser | A stealth-focused Chromium fork that modifies browser fingerprints, including GPU, canvas, WebGL, audio, fonts, user-agent, and TLS signals, at the source-code level. We ran it through a residential proxy with its optional humanization features for mouse and keyboard input enabled. |
| Browser Use | An open-source AI-agent framework that uses an LLM (Claude Opus in our setup) and visual page information to plan actions and operate an unmodified browser from cloud infrastructure. |
| Perplexity Comet Uses | Perplexity's AI-powered browser, which uses an LLM and visual information to navigate webpages and complete tasks. |
| Grok | xAI's browser-use agent, which uses an LLM and visual information to navigate and complete web tasks. |
Results
We found that detection performance varied substantially across systems. Aggregated across all adversaries, Proof of Human identified 99% of automated sessions, followed by reCAPTCHA v3 at 69.4%, hCaptcha at 44.3%, Cloudflare Turnstile at 42.1%, and Cloudflare Bot Management at 9.1%.
Figure 1: Bot benchmarking results. Each bar shows the percentage of automated sessions identified by the given detection system, aggregated across all five adversaries.
Performance differed considerably by adversary. The clearest split was between scripted browsers and AI agents. hCaptcha and Cloudflare Turnstile caught nearly every scripted Chromium and CloakBrowser session but few of the AI-agent sessions. reCAPTCHA v3 showed the opposite pattern, identifying most agent sessions but none from CloakBrowser. Cloudflare Bot Management caught few sessions from any adversary, while Proof of Human detected at least 95% of sessions overall.
Figure 2: Percentage of sessions identified as automated for each combination of detection system and adversary. Green cells indicate adversaries that were caught; red cells indicate adversaries that fooled the detection system.
As most detection systems are black-box, we cannot directly determine which signals produced each result. However, the systems' observed behavior, together with publicly available documentation, suggests several likely sources for this failure:
- reCAPTCHA v3 detected most sessions from standard Chromium and the cloud-hosted agents but did not detect CloakBrowser. CloakBrowser was the only adversary that combined a source-level modified browser fingerprint with a residential IP address. Our results cannot determine whether its browser fingerprint, residential IP, or a combination of the two was primarily responsible for its success.
- hCaptcha gave challenges to both Chromium and CloakBrowser, neither of which could reliably complete the image-based task. By contrast, the three vision-capable agents—Browser Use, Grok, and Perplexity Comet—were generally able to interpret and solve the image grid, allowing most of their sessions to pass.
- Cloudflare Turnstile detected both scripted-browser adversaries: Chromium and CloakBrowser failed to receive verification tokens, even after the full 30-second waiting period. However, it did not detect any of the three AI agents, and did not even issue challenges during these sessions.
- Cloudflare Bot Management detected relatively few sessions overall. This pattern is consistent with the stealth browser and cloud agents presenting clean browser-level signals, although the higher detection rate for Grok may reflect infrastructure-level signals Cloudflare uses, such as IP or TLS reputation.
Limitations
Several limitations should be considered when interpreting these results:
- Some systems crashed or failed before completion, resulting in slightly different sample sizes across conditions.
- We evaluated the product tiers available to us rather than enterprise versions, which may incorporate additional signals or more advanced detection capabilities.
- We measured detection rates for automated sessions but did not evaluate false-positive rates among human respondents.
- Some systems, including reCAPTCHA, may become better calibrated as they observe more traffic and establish a reputation for a website. Detection rates could therefore differ in a longer-running deployment.
Conclusion
Our results suggest that bot detection is entering a new phase. Traditional automation signals remain effective against scripted browsers, but they are less reliable against AI agents that genuine browser environments intelligently. Interactive challenges may offer limited protection when vision-capable agents can interpret and complete them. And as browser-level indicators become easier to avoid, the way a user behaves throughout a session becomes increasingly important for distinguishing human activity from automation.
Future benchmarks should test larger volumes of traffic, include human participants to measure false-positive rates, and evaluate more complex tasks and emerging agents. At Proof of Human, we will continue tracking these changes and developing methods in this evolving threat landscape. To test Proof of Human on your own application, visit poh.org.