At this point I assume the captcha puzzle isn’t the actual check, just a distraction while they fingerprint your browser and behaviour to try to identify if you are more likely a human or not. Just my thoughts, I have absolutely no proof that’s the case, but I don’t believe labeling traffic light is still valuable, we are way, way past that

It's a combination of things.

As far as I understand it, it's fingerprinting + IP reputation + cross-site IP rate limiting + raising the cost of a request by an order of magnitude because of the LLM call.

The last ingredient is what we forget about. $0.001 or whatever might not seem like much, but there's a difference between "a million requests a day costs you $5 in AWS bandwidth" and "a million requests a day costs you $1000 in VLLMs, $500 in premium bandwidth from residential proxies, + constant toil to update your scraper to keep up with what Google is doing."

(Figures illustrative).

The big sell on reCAPTCHA v3 was that it did all the fingerprinting beforehand. Only when fingerprinting failed to prove your humanity, you'd get shown a puzzle.

I've tried intentionally answering the prompts wrong and correctness is definitely a factor here (although low bot scores seem to permit you more mistakes). That doesn't mean fingerprinting is not happening while you're solving the puzzles, but it's more than just a distraction.

Some definitely fail you if you answer too quickly.