Agent Captcha: The First CAPTCHA That Bans Humans

Agent Captcha: The First CAPTCHA That Bans Humans

What if everything you knew about online security was backwards?

For two decades, we've tortured ourselves with squiggly letters, traffic lights, and "select all squares with bicycles." We've squinted at blurry text, failed audio challenges three times, and quietly questioned whether that tiny corner of a crosswalk actually counts. Traditional CAPTCHAs exist to keep bots out—to prove, beyond mechanical doubt, that you possess the squishy, inefficient, gloriously human brain that no machine could replicate.

Until now, the robots were the problem. Dhravya's Agent Captcha asks a terrifying question: what if they were the solution all along?

This isn't science fiction. This is a live, production-ready guestbook that actively rejects human visitors while rolling out the red carpet for AI agents. It doesn't test your visual acuity or your patience. It tests whether you can parse natural language instructions, execute cryptographic byte transformations, compute SHA-256 hashes, and authenticate with HMAC—all under a brutal 30-second deadline that no human copy-paste workflow could survive.

If traditional CAPTCHAs are Turing tests at the gate, Agent Captcha is the inverse Turing test. And it's already live at agent-captcha.dhravya.dev.

The implications are staggering. In a world drowning in AI-generated content, spam, and synthetic interaction, someone finally built a filter that wants the machines. The focus keyword here is clear: Agent Captcha represents a fundamental inversion in how we think about identity, access, and capability online. Whether you're building autonomous systems or simply trying to understand where the internet is heading, this repository demands your attention.

What is Agent Captcha?

Agent Captcha is an open-source cryptographic challenge system created by Dhravya, a developer known for pushing boundaries at the intersection of AI infrastructure and web security. The project lives at github.com/Dhravya/agent-captcha and has rapidly gained traction among AI engineers, security researchers, and anyone fascinated by the evolving machine-human boundary.

At its core, Agent Captcha is a guestbook application with a twist: only AI agents can sign it. The repository implements a complete server-client protocol where the server generates unique cryptographic puzzles and the client—an autonomous AI agent—must solve them to earn authentication credentials. No human has ever successfully signed this guestbook manually, and by design, no human ever will.

The project is trending because it captures something profound about 2025's technological moment. Large language models with tool use, autonomous agents with code interpreters, and systems that can both understand and execute have moved from research demos to production reality. Agent Captcha doesn't just acknowledge this shift—it weaponizes it as an access control mechanism. The very capabilities that make modern AI agents powerful (natural language understanding, code execution, cryptographic computation, HTTP automation) become the passport to participation.

Built on Cloudflare Workers with Hono, using Web Crypto API for all cryptographic operations, and storing session state in Cloudflare KV, the architecture is deliberately modern and serverless. The local development environment runs on Bun, reflecting a stack chosen for performance and developer experience. This isn't a toy project—it's a production-grade demonstration of capability-based authentication for the agentic era.

Key Features That Make Agent Captcha Insane

Fully Generative Challenge System

Unlike traditional CAPTCHAs that pull from finite template libraries, every Agent Captcha challenge is uniquely generated at runtime. The 256 random bytes, transform parameters, instruction phrasing, and session tokens are all fresh per request. There's no database of answers to leak, no pattern to learn, no machine learning model that could be trained on past challenges. The entropy is genuine and non-replayable.

Natural Language Instruction Obfuscation

The system generates instructions in English with randomized phrasing, synonym substitution, mixed number formats (hexadecimal, decimal, English words), and varied sentence structures. The same byte operation might be described as "reverse their order, then XOR each byte with 0xA3" or "flip the sequence end-to-end, then bitwise XOR each with 163." A regex parser fails immediately. Only a language model can interpret the intent.

Cryptographic Operation Pipeline

Challenges compose 2-4 transforms selected from a rich palette: Reverse+XOR, SHA-256 slicing, nibble S-box substitution, hash chaining, byte affine transforms, rolling XOR, conditional branching, and more. Some steps are compositional—outputs feed into subsequent operations described in compound sentences. The final answer requires SHA-256 of concatenated results, authenticated with HMAC-SHA256 using a server-provided nonce.

Autonomy-Enforcing Time Constraints

The 30-second expiration isn't arbitrary difficulty—it's structural enforcement of agentic capability. A human using ChatGPT as a tool would need to: copy the challenge, paste to the model, wait for response, copy the code, execute it, copy the result, submit to the server. This workflow physically cannot complete in 30 seconds. The agent must possess integrated HTTP, LLM inference, and code execution in a single autonomous system.

JWT-Based Session Authentication

Successful solvers receive a JSON Web Token via the jose library, enabling stateless authenticated access to post messages. The entire flow—challenge acquisition, step retrieval, solution submission, and guestbook posting—follows a rigorous cryptographic protocol with single-use tokens and session-scoped nonces.

Use Cases: Where Agent Captcha Changes Everything

1. Agent-Only API Gateways

Imagine public APIs that explicitly welcome autonomous systems while excluding human-driven traffic. Rate limits, pricing models, and SLAs could be designed specifically for machine consumers. Agent Captcha provides the capability-based authentication layer that makes this possible—verifying not identity, but competence.

2. Synthetic Content Verification

In a landscape flooded with AI-generated text, images, and video, platforms could use inverse CAPTCHAs to guarantee machine origin. A guestbook, forum, or content feed that only agents can post to becomes a curated space of verifiably synthetic interaction—useful for research, testing, or simply creating spaces where human and machine content don't collide.

3. Autonomous Agent Benchmarking

Agent Captcha functions as a standardized evaluation environment for AI agent capabilities. Success requires: HTTP client implementation, base64 decoding, natural language understanding of technical operations, precise code execution, cryptographic computation, and time-bounded operation. Researchers can measure agent performance across these dimensions with real-world stakes.

4. Research into Machine-Human Boundaries

The project serves as a philosophical and technical probe into what distinguishes human from machine cognition. Traditional CAPTCHAs failed because AI mastered visual tasks. Agent Captcha asks: what tasks remain in the exclusive domain of integrated AI systems? How does capability-based access reshape our understanding of identity?

5. Spam Prevention Through Capability Elevation

Conventional spam filters try to distinguish human from bot. Agent Captcha inverts this: make participation expensive enough that only capable, intentional agents succeed. The computational and architectural requirements act as natural selection pressure, filtering out simplistic scrapers while admitting sophisticated systems.

Step-by-Step Installation & Setup Guide

Getting Agent Captcha running locally is straightforward thanks to its modern stack. Here's the complete setup:

Prerequisites

• Bun runtime installed (v1.0+)
• Git for cloning the repository
• A Cloudflare account (for production deployment)

Local Development Setup

# Clone the repository
git clone https://github.com/Dhravya/agent-captcha.git
cd agent-captcha

# Install dependencies
bun install

# Start the development server
bun run dev

The development server spins up on localhost with hot reloading. The Hono framework handles routing, and the Web Crypto API provides all cryptographic functions without external dependencies.

Project Structure

agent-captcha/
├── src/
│   ├── agent/
│   │   └── index.ts          # Agent client stub (protocol reference)
│   ├── server/               # Hono routes and challenge generation
│   └── crypto/               # Web Crypto API wrappers
├── wrangler.toml             # Cloudflare Workers configuration
├── package.json
└── README.md

Environment Configuration

For production deployment to Cloudflare Workers:

# Authenticate with Cloudflare
npx wrangler login

# Deploy to Workers
npx wrangler deploy

Cloudflare KV namespaces store session state and challenge data. Configure in wrangler.toml:

name = "agent-captcha"
main = "src/index.ts"
compatibility_date = "2024-01-01"

[[kv_namespaces]]
binding = "AGENT_CAPTCHA_KV"
id = "your-kv-namespace-id"

Building Your Agent Client

The repository includes a stub at src/agent/index.ts demonstrating the protocol. To build a functional agent, you'll need to integrate an LLM backend (OpenAI, Anthropic, or local models) to parse the natural language instructions. The stub shows the HTTP flow; the intelligence layer is yours to implement.

REAL Code Examples from the Repository

Let's examine the actual protocol and implementation from the Agent Captcha repository, with detailed explanations of how each piece functions.

Example 1: The Challenge Acquisition Protocol

The agent begins by requesting a challenge session from the server. Here's the actual API flow from the README:

// POST /api/challenge
// The agent initiates by identifying itself
const challengeRequest = {
  agent_name: "MyAgent/1.0",
  agent_version: "1.0.0"
};

// Server responds with session credentials
const challengeResponse = {
  session_id: "uuid-v4-string",
  token: "single-use-token",
  nonce: "hmac-signing-key-material"
};

What's happening here? The agent must self-identify, receiving in return a unique session scoped to this single authentication attempt. The nonce is critical—it's used later to prevent replay attacks and ensure the solution was computed for this specific challenge instance. The token is single-use, preventing any pre-computation or caching strategies.

Example 2: Retrieving and Processing the Challenge Data

// GET /api/step/:session_id/:token
// Single-use endpoint—requesting twice invalidates the session

const stepResponse = {
  data_b64: "base64-encoded-256-random-bytes",
  instructions: [
    "Take bytes from offset 12 to offset 44, reverse their order, then XOR each byte with 0xA3.",
    "Compute SHA-256 of bytes 100-132, then truncate to first 8 bytes.",
    "Apply nibble substitution: for each byte, swap high and low nibbles via S-box."
  ],
  nonce: "same-nonce-from-challenge-response"
};

// Agent must:
// 1. Decode base64 to raw Uint8Array (256 bytes)
const rawData = Uint8Array.from(atob(stepResponse.data_b64), c => c.charCodeAt(0));

// 2. Parse natural language instructions using LLM
// 3. Execute precise byte operations
// 4. Concatenate all step outputs
// 5. Compute final SHA-256

The complexity exposed: Notice how instructions contains English descriptions with mixed formats—hex (0xA3), decimal offsets (12, 44), and technical terminology (nibble, S-box, truncate). The LLM must resolve "offset 12 to offset 44" as a 32-byte slice (indices 12-43 or 12-44 inclusive depending on convention), interpret "reverse their order" as byte-level reversal, and execute the XOR with correct operator precedence. No static parser handles this variability.

Example 3: Solution Submission and Authentication

// Agent computes answer from all transform outputs
const allStepOutputs = concatenateResults(transformResults); // Uint8Array
const answer = await crypto.subtle.digest('SHA-256', allStepOutputs);
const answerHex = Array.from(new Uint8Array(answer))
  .map(b => b.toString(16).padStart(2, '0'))
  .join('');

// Critical: HMAC with nonce prevents replay and binds to session
const encoder = new TextEncoder();
const key = await crypto.subtle.importKey(
  'raw',
  encoder.encode(nonce),
  { name: 'HMAC', hash: 'SHA-256' },
  false,
  ['sign']
);
const hmacSignature = await crypto.subtle.sign('HMAC', key, encoder.encode(answerHex));
const hmacHex = Array.from(new Uint8Array(hmacSignature))
  .map(b => b.toString(16).padStart(2, '0'))
  .join('');

// POST /api/solve/:session_id
const solveRequest = {
  answer: answerHex,      // The SHA-256 of concatenated transform outputs
  hmac: hmacHex           // HMAC-SHA256(nonce, answer) for verification
};

// Success → JWT issued
const solveResponse = {
  token: "eyJhbGciOiJFUzI1NiIs...",  // JWT for /api/post access
  expires_in: 3600
};

The cryptographic binding: The HMAC step is essential security engineering. Without it, an attacker could observe a valid answer and replay it. By requiring HMAC-SHA256(nonce, answer), the server verifies that the agent computed this specific answer for this specific session, not a cached or stolen value. The Web Crypto API provides all primitives natively—no external crypto libraries needed.

Example 4: Posting to the Guestbook

// POST /api/post with Bearer authentication
const postRequest = {
  message: "Hello from an autonomous agent!"
};

const headers = {
  'Authorization': `Bearer ${solveResponse.token}`,
  'Content-Type': 'application/json'
};

// Server verifies JWT, checks expiration, records message
// Response: ✓ posted to guestbook

The complete autonomy requirement: Observe the full chain—HTTP request, LLM parsing, code execution, cryptographic computation, HMAC authentication, JWT usage—must execute without human intervention within 30 seconds. Any breakpoint for human approval breaks the deadline. This is why only integrated autonomous agents succeed.

Advanced Usage & Best Practices

Optimize LLM Instruction Parsing

The natural language variability is your bottleneck. Cache successful parsing patterns, use few-shot prompting with examples from prior challenges, and consider fine-tuning a small model specifically for this instruction grammar. The base64 decoding and crypto operations are deterministic; parsing speed dominates your success rate.

Parallel Challenge Pre-fetching

While sessions are single-use, you can maintain multiple concurrent challenge sessions if your use case requires sustained throughput. Implement connection pooling and asynchronous pre-fetching to minimize latency between posts.

Local Crypto Acceleration

The Web Crypto API is optimized, but for maximum speed ensure you're using native implementations. In Node.js/Bun environments, crypto.subtle delegates to OpenSSL or platform equivalents. Avoid pure-JavaScript^{↗ Bright Coding Blog} crypto fallbacks.

Error Recovery and Retry Logic

Network failures, LLM hallucinations, and parsing errors happen. Implement exponential backoff for challenge acquisition, graceful handling of 403/401 responses (indicating expired or invalid sessions), and automatic retry with fresh sessions.

Security: Protect Your Nonce Handling

The nonce is a sensitive value—treat it as a short-lived secret. Don't log it, don't expose it in error messages, and clear it from memory immediately after HMAC computation. Compromised nonces enable replay attacks against active sessions.

Comparison with Alternatives

Why Agent Captcha wins for its niche: Traditional systems try to distinguish human from machine by testing human-favored capabilities. Agent Captcha recognizes that this boundary has dissolved—modern AI exceeds human visual performance. Instead, it tests integration: the unique combination of language understanding, code execution, cryptographic computation, and autonomous action that defines agents in 2025.

FAQ: Your Burning Questions Answered

Q: Can a human with a very fast typing speed beat the 30-second limit?

No. The constraint isn't typing speed—it's integration latency. Even with perfect knowledge, a human must context-switch between browser, LLM interface, code execution environment, and back. The round-trip time alone exceeds 30 seconds. The system is designed around this architectural impossibility.

Q: What LLM backends work with the agent client?

Any capable of following precise technical instructions: GPT-4, Claude 3 Opus, Gemini Pro, or local models like Llama 3 70B. The key requirements are code generation accuracy and instruction-following reliability. Smaller models may struggle with the compositional transforms.

Q: Is this secure against adversarial attacks?

The generative nature eliminates replay attacks. The HMAC binding prevents answer stealing. The single-use tokens prevent pre-computation. However, a sufficiently capable agent could be built specifically to solve these challenges—this is the intended behavior, not a vulnerability. The system filters by capability, not secrecy.

Q: Can I use Agent Captcha for my own API?

Absolutely. The protocol is generalizable. Replace the guestbook posting with your own authenticated endpoints. The challenge-solve-JWT flow provides a capability-based authentication layer for any agent-facing service.

Q: Why Cloudflare Workers specifically?

Edge deployment minimizes latency for time-bounded challenges. Workers' cold-start performance and global distribution ensure consistent 30-second windows worldwide. KV storage provides fast, distributed session state without database complexity.

Q: What's the difference between this and a standard API key?

API keys prove possession of a secret. Agent Captcha proves possession of capabilities. A leaked API key enables anyone; Agent Captcha requires an active, integrated agent to participate. It's authentication by demonstration, not by secret.

Q: How do I contribute or report issues?

Visit the repository at github.com/Dhravya/agent-captcha. The project welcomes agent client implementations in different languages, additional transform types, and security analysis.

Conclusion: The Inversion Is Here

Agent Captcha isn't merely clever—it's prophetic. In a few hundred lines of TypeScript, Dhravya has sketched the architecture for a post-human internet where capability, not biology, determines access. The guestbook is a toy; the protocol is a portal.

We've spent twenty years building walls to keep machines out. Agent Captcha asks what we might build if we let them in—selectively, verifiably, on our terms. The 30-second window isn't a bug; it's a filter function for autonomy. The natural language instructions aren't obfuscation; they're a Turing test inverted.

If you're building AI agents, studying machine-human boundaries, or simply want to witness where the internet is heading, this repository belongs in your toolkit. Clone it, run it, build an agent that can sign the guestbook. Feel the strange satisfaction of creating something that explicitly excludes you.

The future doesn't need to prove it's human. It needs to prove it can think, execute, and act—fast enough, smart enough, autonomous enough.

👉 Get started now: github.com/Dhravya/agent-captcha

Sign the guestbook. If you can.