# A Low-Cost Attack against the hCaptcha System

arXiv: https://arxiv.org/abs/2104.04683 · HTML: https://mlsanity.com/paper/2104.04683/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Apr 2021.

## Built on by (most cited first, 2 of 2)

- [Infrastructure for AI Agents](https://mlsanity.com/paper/2501.10114/) (2025)
- [BOTracle: A framework for Discriminating Bots and Humans](https://mlsanity.com/paper/2412.02266/) (2024)

## Abstract (arXiv)

CAPTCHAs are a defense mechanism to prevent malicious bot programs from abusing websites on the Internet. hCaptcha is a relatively new but emerging image CAPTCHA service. This paper presents an automated system that can break hCaptcha challenges with a high success rate. We evaluate our system against 270 hCaptcha challenges from live websites and demonstrate that it can solve them with 95.93% accuracy while taking only 18.76 seconds on average to crack a challenge. We run our attack from a docker instance with only 2GB memory (RAM), 3 CPUs, and no GPU devices, demonstrating that it requires minimal resources to launch a successful large-scale attack against the hCaptcha system.