You are trying to log in to a website, and instead of the page crisply rendering, you are presented with an infuriating brainteaser.

The puzzle shows you seven small, low-resolution pictures of different animals and instructs you to find the one with similar eating habits to those of the animal in an eighth picture – a cow on a red background.

You scan over the fuzzy images – “Is that a horse or a lion? What do pelicans eat again?” – before settling on the final image, a sheep.

Congratulations, you have proved you are a human, if a slightly annoyed one. At best, you have wasted a few seconds. At worst, a fat finger or momentary brain lapse means you will be forced to start the whole process again.

These “are you a robot” tests, known as captchas, have been a fixture of the web for as long as most people have been online. The now-defunct search engine Altavista introduced a rudimentary bot test in 1997. Earlier ones at least served a purpose: captchas originally asked you to write out a word scanned from a historical text as part of a crowdsourced effort to digitise books.

But the rise of cyber-attacking bots and, more recently, advanced AI systems, has accelerated a defensive arms race, making these tests harder. In the process, it has made the web slower and more irritating to its human users.

In 2024, bot traffic to websites surpassed human traffic for the first time, according to cybersecurity company Imperva. The company said the rise of chatbots, which scrape the web for information, and AI that helps bots evade detection, had contributed to this rise.

“The sheer volume of AI agents harvesting data to train large language models has completely broken the old math[s],” says Bryan Becker, the director of product at Cloudflare, which develops anti-bot systems.

Bots are evading captchas

Website owners, on the whole, do not like bots. They can be used to overload victims with traffic, taking them offline. Often, they are used by competitors to scrape pricing data or by opportunistic touts to buy tickets or book driving test slots.

And a growing number of “AI agents” are using them to carry out tasks on their users’ behalf, meaning there is no human to see adverts or be enticed into impulse purchases, and often harvesting data without their consent.

Captchas and other bot tests are now ubiquitous. Cloudflare, which relies on other tests such as the “verify you are a human” tick boxes, says it now carries out 7.7 billion anti-bot checks a day, up from 2.1 billion in 2023.

But bots have become better at evading them. Two years ago, researchers at the University of Zurich found that machine learning systems could solve 100pc of robot tests provided by reCaptcha, Google’s captcha system (the company is responsible for the quizzes asking you to click all the squares containing buses, bridges or fire hydrants out of a grid of 16 squares).

In response, companies have made the tests harder. Bot prevention company Arkose Labs, used by many tech companies, asks web visitors to choose which pair of dice adds up to seven, or move a cartoon person to the right plane seat. The company advertises its tests as “AI-resistant”.

Rival company hCaptcha shows people nine pictures of food and drink, asking them to choose which ones are a main course. “I think they are made to prevent humans,” one online complaint reads.

A spokesman for hCaptcha said its data showed the tests were not taking humans longer to complete, “but the diversity of questions has increased over time as attacks have evolved”. The company says it needs to constantly update its tests to keep up with automation.

While humans generally do not have difficulty with the tests, disability groups say they often lock out those with eyesight problems. And the time it takes to complete them adds up. Cloudflare said five years ago that it takes an average of 32 seconds to complete a captcha, which means humanity collectively wastes 500 years a day on them.

Increasingly complex prevention measures also risk slowing down the internet, adding more security systems to web pages.

“The entire captcha concept is ultimately a losing battle. It may seem like an arms race but we, humans, already lost it,” says Prof Gene Tsudik, of the University of California, Irvine.

Some sites are taking more drastic measures, such as demanding users sign up for accounts or log in more frequently to prove they are human. Reddit said earlier this month it would require users to be logged in to see old posts, to “tighten how automated systems access Reddit”.

There is little sign that the bots are going away, nor the need to defend against them. “Failing to stop the bots is actually worse, because an unmitigated tidal wave of automated traffic will completely overwhelm origin servers and knock websites offline,” says Cloudflare’s Becker.

Humans are now a minority on the web. Proving that you are one of them is going to get harder.