Google charges $1.00 per 1,000 questions. The answers sell for $0.40. The industry’s fix is not a better test, it is a turnstile that takes payment.
Proving you are human costs about a tenth of a cent per attempt, and buying a passing answer on the open market costs roughly the same. A control priced at parity with its own defeat is not a wall. It is a toll that anyone can afford. So the companies that sell bot detection have quietly stopped selling exclusion and started building the rails to sell admission instead.
The Wall Street Journal ran a useful explainer on Monday about why you still see grids of traffic lights when bots have gotten good at solving them. The reporting is right. The framing everyone picked up from it, that this is an arms race between detection and evasion, is the least interesting thing in the story.
Arms races are about capability. This one was decided on unit cost years ago, and the scoreboard is published on vendor pricing pages in dollars per thousand.
What Happened
The Journal’s piece, by Jackie Snow, lays out where captchas stand in September 2026. Visible puzzles are slightly less common than a year ago. Detection has moved to silent behavioral scoring that watches cursor movement, scroll rhythm, typing cadence, IP reputation and device type across a whole session. Bots are learning to fake the jitter of a real hand.
The number that should have been the headline came from a researcher at Shanghai Jiao Tong University, Yun Lin, who built an AI agent that solved captchas in 70% of attempts with no special training, and thinks more engineering pushes it past 90%.
Set that against the price list. Google’s own billing documentation puts reCAPTCHA at no cost for the first 10,000 assessments a month, $8 flat to 100,000, and $0.001 per assessment after that. One dollar per thousand questions.
Commercial solving services publish their side of the same ledger. 2Captcha lists reCAPTCHA v2 at $1.00 to $2.99 per 1,000 solves. NSLSolver lists Cloudflare Turnstile at $0.40 per 1,000 and reCAPTCHA v3 and Enterprise tokens at $1.50. You pay only for successful solves.
The defender’s published rate sits inside the attacker’s published range. On Turnstile, breaking the check is cheaper per event than Google charges to run one.
That is not a technology gap. That is a market clearing.
The Backstory: Captcha Started as a Labor Scheme
The original business model was never security. It was extraction.
Early captchas asked you to type warped words, and reCAPTCHA quietly used those keystrokes to digitize books and street numbers that optical character recognition could not read. Later versions had you box in buses and crosswalks, which happens to be exactly the labeling work computer vision models needed. Every visitor paid a few seconds of unpaid labor, and the site owner paid nothing. hCaptcha built a whole company on making that trade explicit, monetizing through machine learning data labeling rather than advertising.
That arrangement had a beautiful property: the cost of the control was borne entirely by the user, in time, and the output had resale value.
Both halves broke.
The labor stopped being valuable first, because models got better at labeling than the crowd. Then Google repriced the remaining function. On 1 April 2024 the free allowance dropped from a million assessments a month to ten thousand, a 99% cut, and every legacy key was migrated onto Google Cloud billing. A control that used to be free and self-funding became a metered line item on a cloud invoice.
Ask a website operator what changed about captchas and they will not tell you about AI. They will tell you they got a bill.
The Test Failed on Arithmetic, Not on Intelligence
Cloudflare, which sits in front of roughly a fifth of the web, watched automated requests pass human ones this year. Bots now generate about 57% of the traffic it sees, against roughly 20% before generative AI. Its 2026 threat intelligence work puts bots at 94% of all login attempts on the network.
Read that last figure slowly, because it is the whole story. On the single surface where captchas actually live, the login box, the human is a 6% edge case. Anomaly detection only works when the anomaly is rare. Once the anomaly is 94% of the population, you are not filtering, you are re-founding the internet on a presumption of guilt and then apologizing to the minority who are people.
The economics of the challenge follow. Google’s cloud security director Abhishek Hemrajani makes the point almost by accident in the Journal piece when he explains why the company now leans on things like scanning a QR code with a phone: pulling a human into the loop makes an attack uneconomical at scale.
That is a confession dressed as product strategy. The defense was never truth. It was cost imposition. Captcha worked for fifteen years because a fraction of a cent times ten million attempts used to be real money to an attacker, and AI dropped the attacker’s marginal cost faster than anyone could raise it.
Then there is Brian Becker, a Cloudflare product director, on the shelf life of everything built in this category. His line to the Journal is that these technologies “last about 12 months.”
Twelve months is not a product. It is a depreciation schedule. Nobody capitalizes an asset that expires within the fiscal year, which is why this function cannot be licensed, cannot be sold once, and only survives bundled into a subscription with a permanent maintenance budget attached. The subscription structure is not a pricing preference here. It is the only form a self-consuming product can take.
The Wall Is Free. The Gate Is the Product.
Now look at how the two biggest players price the identical function.
Google charges per assessment above the free tier. Cloudflare gives Turnstile away: unlimited challenges, no card, no volume cap, on a plan that costs nothing.
Two rational firms, opposite answers, same demand shock. The difference is where each one makes money after the question is answered.
For Google, verification is a Cloud SKU, so it gets a rate card. For Cloudflare, the free widget is a sensor. Its signals feed the edge, where bot management, the WAF and enterprise contracts are sold, and where a much larger opportunity opened up. Turnstile even added a toggle in May 2026 to challenge AI scrapers by name.
Here is where the business model actually moved. Cloudflare revived HTTP status code 402, Payment Required, which had sat unused in the spec since the 1990s. Pay Per Crawl lets a publisher set a flat per-request price and gives three options per crawler: allow free, charge, or block. Cloudflare acts as merchant of record and runs the settlement. New domains default to blocking training and agent crawlers on ad-supported pages while leaving search crawlers alone.
The company says publishers now send more than a billion 402 responses to AI crawlers every day.
By July 2026 it went further, arguing that crawling is a poor proxy for value, since one page can be fetched once and cited in thousands of answers, and started testing payment on the answer instead. Its Monetization Gateway extends the same x402 rail to any resource behind Cloudflare: an API, a dataset, a tool call.
On the Q2 call, Matthew Prince framed the company as building the payment rails for machine-to-machine traffic, with micro-transactions in fractions of a penny per request. Blocking, he noted, stays free. Revenue landed at $696.1 million for the quarter, up 36%, with net retention at 120%.
Free wall, paid gate. Once you see it, the captcha stops looking like a security control and starts looking like the metering point on a pipe, which is the position every intermediary in ad tech spent twenty years fighting to own.
The Business Model Angle
The moat moved from detection to identity issuance. Any detector decays in about a year. What does not decay is being the party that both sides trust to say which agent is which, and to hold the money in between. Cloudflare gave away the detector to win the registry, which is the same trade Google made handing out Chrome and Android.
Verification is becoming a payments business with a security origin story. Merchant of record, settlement, per-request pricing, a dispute surface. Those are payments primitives. The winner of the bot war will file its revenue in a line item that looks nothing like a firewall, and the sharpest competitive risk to Cloudflare is not another WAF vendor, it is Stripe.
Every site with a login now runs an unpriced admissions desk. If bots are 94% of login attempts, the largest cost center on your site is deciding who gets in, and almost nobody has a number for it. The picks-and-shovels lane is agent identity, delegated credentials, per-agent rate cards and the audit trail proving which machine acted on whose behalf. That last one is already a live problem, as anyone whose subscription got drained by a stolen session found out when they asked for an itemized bill.
The Risk
The toll booth assumes crawlers agree to be crawlers.
Pay Per Crawl works against declared, well-behaved bots that identify themselves and want a durable relationship. It does nothing against traffic that arrives wearing a residential IP and a plausible mouse path, which is precisely the traffic the behavioral systems were built to catch and increasingly cannot. Charging the honest while the dishonest walk past is how ad tech got its fraud problem, not how it got its revenue.
The second risk is on the demand side. A price only exists if someone pays it. More than a billion 402 responses a day is a big number of invoices sent, and it is not a number of invoices settled. Cloudflare has not published what publishers actually collect, and its own pivot toward paying per answer rather than per crawl reads like an admission that the first pricing unit did not clear. Publishers weighing whether to cut Google off are running the same experiment from the other end, with the same missing number.
Third, this whole edifice sits on one company’s ability to keep classifying traffic well enough that its verdicts are worth paying to overturn. Twelve-month shelf life, remember.
Quick Questions
Are captchas going away? No. They are becoming the exception path. The default is silent scoring, and the visible puzzle is what you get when the score is ambiguous or the site never upgraded.
Why do I see more of them than my friend? Shared IPs, VPNs, corporate and university networks, incognito windows and desktop browsers all read as thinner or dirtier signal. Researchers quoted in the Journal report far fewer challenges on phones than on laptops.
Do I fail if I miss an ambiguous square? Generally no. Edge cases where the crowd splits get very little weight.
Is this the same treadmill as browser patch cadence? Related, and worth reading next to Chrome’s move to two-week releases, where the same AI-driven defect discovery is reshaping how software ships rather than how it authenticates.
The Business Model Analyst Take
The captcha was always a price, not a proof. It bought you nothing except the knowledge that whoever got through cared enough to spend a fraction of a cent. AI did not defeat the test. It repriced the input until the toll stopped filtering anyone.
What comes next is not a cleverer puzzle. It is a ledger. Hemrajani says the question is shifting from whether a visitor is a bot to whether its intentions are good. Becker says the hard part is letting the good bots through without slowing everyone else down. Strip the security language and both men are describing an accounts receivable problem: identify the counterparty, price the access, settle the transaction, keep the receipt.
The web spent thirty years pretending admission was free because checking cost more than it was worth. Machines outnumber us now, and the checking got cheap. The turnstile was always going to grow a coin slot..
