[DigitalToday reporter Chi-gyu Hwang] As AI spreads and the number of bots rises rapidly, CAPTCHAs - image puzzles or checkboxes used by websites to verify whether a user is human or a bot - are evolving.

As bots have become far better at solving CAPTCHA puzzles, websites are deploying AI-powered bot detection in more user-friendly ways that are less noticeable.

At this point, you might think you will never see CAPTCHAs again, but that is not the case.

According to a recent Wall Street Journal report, CAPTCHAs have not disappeared and still play an important role in the fight to stop bots from posting spam, attacking websites and scraping content without authorisation.

As AI spreads, websites have a greater need to distinguish real users from bots. Cloudflare, an internet infrastructure company that provides web security and bot detection tools, said bot traffic surpassed humans as of June. Bots accounted for 57 percent of total traffic. If websites fail to properly control bots, they could struggle to operate services due to issues such as site overload.

That is why the argument for CAPTCHAs still holds.

But the way the fight between bots and websites plays out has changed sharply. As both CAPTCHAs and bots evolve with AI behind them, a new battle is unfolding between bots and websites.

Early CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) showed distorted letters that users had to type before entering a site. As bots improved at recognising text, CAPTCHAs developed into more complex image puzzles, such as selecting all boxes that contain bicycles or traffic lights.

As AI technology advances, the effectiveness of image puzzles is also being put to the test. Yun Lin (윤 린), a researcher at Shanghai Jiao Tong University, developed an AI agent that can solve CAPTCHAs with about a 70 percent success rate without additional training. He expects the success rate can be raised to more than 90 percent with further development, the WSJ reported.

Websites are also accelerating efforts to deploy AI to detect bots, in an eye-for-an-eye approach.

AI can analyse user behaviour while a website is being used and score factors such as how fast and natural the cursor moves, scrolling and typing patterns, whether an IP address has a history of suspicious activity, and what device is being used. That allows sites to judge whether the user is human or a bot.

Unlike traditional CAPTCHAs, people cannot recognise such activity, but it still falls within the broad category of CAPTCHAs.

Bots are not simply taking AI CAPTCHAs lying down. They are evolving repeatedly to bypass new AI-based detection technology. Last year, OpenAI's AI agent Operator even broke through Google reCAPTCHA v3, a widely used bot detection system.

Bots are using tools that add natural curves and irregularity to mouse movement paths, mimicking even small imperfections seen in real human movement, the WSJ reported. Cloudflare product executive Brian Becker said via the WSJ, "It is not yet at a level that can fool detection systems, but it is getting closer to that level."

According to the WSJ, Google and Cloudflare, major providers of bot detection technology, also take the view that current bot detection will find it difficult to keep playing the role of problem-solver going forward.

Becker said, "Attackers keep developing new methods and continue to bypass detection technology, so bot detection tends to have a short lifespan," adding, "The lifespan of detection technology is about 12 months. Given the nature of this field, it cannot be helped."

As a result, bot detection technology will continue to evolve, but the industry is focusing on developing technology that analyses the intent of a visit rather than simply distinguishing between bots and humans.

Google Cloud security senior director Abhishek Hemrajani said, "Going forward, the focus may shift from distinguishing whether a visitor is a bot or a human to judging whether the visitor's intent is benign or malicious." Cloudflare's Becker also said, "The biggest challenge will be finding a way to let good bots through without disrupting other users."

Whether image grids featuring bicycles or traffic lights will disappear entirely because AI detection has emerged remains uncertain. Cloudflare said the frequency with which users directly see CAPTCHAs has only fallen slightly from a year earlier. If a bot detection algorithm deems something suspicious, a website may require visual verification such as clicking a checkbox or choosing specific images from a grid, the WSJ reported.