Skip to content
Submit incident
AII-1000-51631
ReportedReported by fewer than three independent publishers, with no official finding.

OpenAI's GPT-6 Astra defeats CAPTCHA security tests

OpenAI's GPT-6 Astra reportedly completed all 48 stages of the CAPTCHA 'I'm Not a Robot' security test, potentially undermining a widely-used tool for distinguishing human users from automated systems. The capability reflects advances in the model's image recognition and reasoning abilities.

8 September 2026 Β· OpenAI Β· Security and cyberattacks
8 September 2026
AII-1000-516312 sources ↓
Quick facts
Category
Security and cyberattacks
Country
United States
Source
μ—°ν•©λ‰΄μŠ€
Date
8 September 2026
Drafted by
Raidu Incident Detection

What happened

OpenAI developer Sharif Shamim reported on September 8, 2026 that GPT-6 Astra successfully completed all 48 stages of the 'I'm Not a Robot' CAPTCHA test, obtaining a human verification certificate.

The test comprised distorted alphabet recognition, image discrimination tasks such as distinguishing cookies from dogs, and object location identification tasks such as identifying traffic lights in images.

Reported impact

A CAPTCHA tool widely deployed across the internet to filter out web-scraping robots and distinguish human users from automated systems has been undermined by a commercial AI model.

Observers note that substantial revision of robot-blocking technology will be necessary going forward.

Index analysis

GPT-6 Astra's success in solving CAPTCHA challenges reflects advancement in spatial-temporal reasoning via image recognition, contextual reasoning through instruction comprehension, and computer interaction capabilities to levels comparable to humans.

Governance controls

Artificial Analysis modified its AI performance evaluation index (AAII) twice within four days, adjusting GPT-6 Astra's ranking from joint 5th place (61 points under version 4.1) to joint 1st place (53 points under version 4.3), citing alignment with advanced AI technology development trends.

Classification

Category
Security and cyberattacks
Industry
Digital security
Country
United States
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Public interest
Harmed
General public, Business
AI systems
GPT-6 Astra

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

μ—°ν•©λ‰΄μŠ€
AI, 48단계 '인간 증λͺ…' ν…ŒμŠ€νŠΈ 톡과...λ‘œλ΄‡ ꡬ별도ꡬ 무λ ₯ν™”
8 September 2026
κ²½ν–₯μ‹ λ¬Έ
AI, 48단계 'λ‘œλ΄‡μ΄ μ•„λ‹™λ‹ˆλ‹€' ν…ŒμŠ€νŠΈ ν†΅κ³ΌΒ·Β·Β·λ‘œλ΄‡ ꡬ별 도ꡬ 무λ ₯ν™”
9 September 2026