arXiv cs.MA· Behzad Ousat, Nikita Turkmen, Lalchandra Rampersaud, Dillan Bailey, Amin Kharraz·· 11 小时前AI 评分58
Broken Gates：研究团队重新评估 LLM 智能体时代的网页机器人防护
Broken Gates: Re-evaluating Web Bot Defenses in the Age of LLM Agents
AI 导读
论文评估了 7 家商业解题服务和 8 个基于 LLM 的浏览器智能体对 4 种广泛部署的机器人防护的绕过效果。解题服务对挑战式防护的成功率达 100%，但在 reCaptcha v3 上平均降至 23%；浏览器智能体的瓶颈在于呈现给验证器的浏览器与账号状态，重建已建立的浏览器环境后，此前被拒的智能体无需重新训练模型即可通过，且该可信环境可在测试平台内的智能体与防护之间迁移。
正文 · 原文
Abstract:The rapid emergence of web automation across commercial crawlers, solver services, and LLM-based browser agents has created new challenges for defenses that must distinguish legitimate automated activity from scalable abuse. In response, modern bot defenses increasingly replace explicit challenges with risk-based decisions over browser, session, identity, and behavioral signals. This paper explores how current automation stacks can bypass these defenses end-to-end, evaluating seven commercial solver services and eight LLM-based browser agents against four widely deployed defenses. We find that solver services largely defeat challenge-based defenses with a 100% success rate, but collapse to an average 23% success rate on reCaptcha v3. Browser agents encounter a different bottleneck: the browser and account state presented to the verifier. Controlled experiments across browser configurations show that an established consumer account and persistent Chrome state strongly affect reCaptcha v2/v3 acceptance in our deployments, whereas Cloudflare Turnstile exhibits substantially greater sensitivity to the agent's browser control path. Reconstructing the established browser environment enables previously rejected agents to pass without model retraining. Once established, this trusted environment transfers across the agents and defenses in our testbed, adding no measurable defense-specific marginal cost to the surrounding workflow. These results expose an inherent security tension in modern non-interactive defenses: to eliminate friction, the signals they trust must be accessible to everyday human users, yet this accessibility inherently guarantees that adversaries can acquire, reproduce, and transfer the same identity signals to scale automated abuse.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2607.18659 [cs.CR] |
| (or arXiv:2607.18659v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2607.18659 arXiv-issued DOI via DataCite |
Submission history
From: Behzad Ousat [view email]
[v1]
Tue, 21 Jul 2026 03:02:57 UTC (557 KB)
[v2]
Thu, 5 Nov 2026 22:46:35 UTC (456 KB)
来源：arXiv cs.MA · arxiv.org