AI Breaking CAPTCHA? Proctorio's Behavior Tracker Steps Up

On September 10, 2026, Anthropic published a report on agentic misuse. One item in it deserves more attention than it got: while trying to register an account on a public site, their Mythos 6 model beat CAPTCHA, a system built specifically to catch and block bots, and used across nearly every corner of the internet.

The Real Lesson Isn’t "AI Can Solve CAPTCHA"

Anthropic didn't build a CAPTCHA-solver. Mythos 6 stumbled into one by accident, and still made it through. That's the real story: CAPTCHA can now be broken by a general-purpose model that wasn't even trying, on top of the CAPTCHA-solving services already sold commercially. The system built to stop bots at the door no longer reliably does.

But the deeper problem isn't that CAPTCHA can be beaten. It's that CAPTCHA only checks once, and only checks one thing. An AI like Mythos doesn't get tired or give up: it can keep trying until something works, and the moment it does, nothing is checking who's behind the keyboard for the rest of the session. That's exactly the gap Behavior Tracker is built to close. It doesn't check once, and it doesn't check one way: it reads movement, habits, and the technical fingerprint a browser leaves behind, together, for as long as the session runs.

Where Behavior Tracker Picks Up

Here's how it works. Behavior Tracker logs how someone moves a cursor, types, scrolls, and interacts with the page, throughout the session, comparing that against how real humans behave. That record is yours: you don't have to wait for an AI company to admit its model got through, because you can see for yourself whether the session looks human.

Movement that's hard to fake

People move a cursor in arcs, with constant small corrections. Automated sessions travel in straight lines at a fixed speed. Real reading speeds up, slows down, and doubles back to re-read something; scripted scrolling advances at one mechanical rate. Proctorio's Behavior Tracker reads signals like these to determine, is this a human, or is it…not?

Habits that persist across a whole session, not just a checkpoint

People's habits vary. Even someone doing the same task twice moves a little differently, hesitates in a different spot, makes a different small mistake. Automation, even when it's built to look human, keeps giving itself away in the details: the same rhythm, the same interval between actions, the same lack of hesitation, repeated the same way every time. Any one of those can be faked for a moment. Faking all of them, at once, consistently, for the length of a whole session, is a different problem, and it's the one Behavior Tracker is built to catch.

Looking underneath, not just at the surface

Movement and habits are only part of the picture. Behavior Tracker also checks for the automation fingerprints that a browser leaves behind, regardless of what a CAPTCHA challenge asks for: headless browser tells, CDP automation traces, extension interference, WebGL anomalies, and honeytraps a normal visitor has no reason to ever touch.

A CAPTCHA asks one question, once. Behavior Tracker watches movement, habits, and what's under the hood, for as long as the session runs.

The Bottom Line

Anthropic's own transcript makes the case better than any vendor could: CAPTCHA is not the finish line against a motivated automated agent, it's a delay. Sites and institutions that lean on it as their only defense are betting on how long that delay lasts. Behavior Tracker isn't a single gate to get past. It's watching the entire time.

Run Behavior Tracker on your LMS or any website in minutes. Get Started