Abstract

CAPTCHA (Completely Automatic Public Turing test to tell Computers and Humans Apart), the cornerstone of web safety, is increasingly vulnerable to deep learning and computer vision-based attacks. This study illustrates a vulnerability in text-based CAPTCHA using a Convolutional Recurrent Neural Network (CRNN) framework that automates solutions with 99.52% accuracy. Traditional defenses — overlapping signs and background noise — are systematically overcome by combining CNNs (for spatial feature extraction) with RNNs (for sequential decoding). To address the lack of data, the model is fine-tuned using a publicly available Kaggle dataset of synthetic CAPTCHA images with sinusoidal distortion, Gaussian noise, and randomized fonts. The model achieves 99.52% accuracy across various variations (strike, blockage, multicolored backgrounds) with a 1.5-second inference time on consumer GPUs, highlighting the practical feasibility of adversarial attacks, and exceeds independent CNN/RNN baselines by over 25%, indicating that static, distortion-dependent CAPTCHA designs are insufficient. Generalizing across unseen fonts and distortion levels confirms that visual obfuscation alone cannot prevent AI-based solving. Beyond its technical contributions, this work offers a framework to catalyze AI-resistance certification research, pointing toward alternative dynamic adaptive visuals, behavioral biometrics, or logic puzzles that better exploit the human-machine cognitive gap.