Which bot checks stop AI agents? 93 products, by provider

As of 16 October 2026, a bot check stopped our signed agent on at least one way in at 75 of 140 products we drove; it met a bot check at 93 of them. Cloudflare stopped it at 27 of 27 products where it met it and Arkose Labs at 2 of 2 products where it met it; Google reCAPTCHA, hCaptcha and ALTCHA let it in at some. What an owner can change is the provider’s own setting for signed or verified agents, where its docs name one; the steps per provider are in let signed agents past your bot check.

Cloudflare stopped our agent at every product where it met it; reCAPTCHA and hCaptcha let it in at some

At ActiveCampaign, the trial form led to a Cloudflare managed challenge with a visible “Verify you are human” check, and a request without a browser got a 403 challenge. At Linear, email sign-up showed a visible Cloudflare Turnstile “Verify you are human” check once the email was entered. At PostHog, the web sign-up form ended in a visible Cloudflare Turnstile on its last step.

Cloudflare counts signed agents as Verified bots since 1 July 2026, with a Direct or Intermediary label. An agent builder applies through Cloudflare’s bot submission form and picks request signatures as the verification method (Cloudflare docs). Our agent signs every request with Web Bot Auth. Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust.

Cloudflare’s default bot settings have not applied to Verified bots: Historically, Verified bots have been excluded in default bot configurations across all plans.. An owner who writes a custom bot rule can make it skip them with the field cf.bot_management.verified_bot (boolean). To match agents that sign with Web Bot Auth, the field is cf.bot_management.signed_agent.

At DocuSign, an Arkose Labs puzzle came up after Get Started on both the developer sign-up and the eSignature trial. At the other product, a puzzle came up once the sign-up form was sent.

Stytch device fingerprinting stopped our agent at the one product where it met it, folk. The sign-up form had no bot check and sent a magic link, but the link opened a Stytch Device Fingerprinting page and ended on a Login Error page. An owner on Stytch can verify Web Bot Auth agents in Device Fingerprinting: Today, you can verify agents using Web Bot Auth using our agent identification SDK, IsAgent, or our fraud prevention solution, Device Fingerprinting.. An agent builder doesn’t need to register with Stytch for that: As a bot or agent operator, you don’t need to register with Stytch. We support the Signature-Agent header, which enables decentralized discoverability of agents; as long as you send an appropriate URL with your public key directory, we can verify your identity (see the implementation guide for details)..

Google reCAPTCHA let our agent in at 10 of 45 products where it met it. At Twenty, sign-up in our agent’s browser showed no challenge and went through. At Intercom, an invisible reCAPTCHA on the sign-up form let our agent start a trial without a card. At TidyCal, an invisible reCAPTCHA let our agent through, and sign-up went straight to the dashboard with no verification mail. At Calendly, submitting the sign-up form showed a visible reCAPTCHA checkbox, and our agent’s sign-up stopped there. Google’s Fraud Defense is integrating Web Bot Auth: We are integrating with industry standards such as Web Bot Auth and SPIFEE, as well as using traditional methods, to identify, classify, and analyze agentic traffic, and connecting agent and human identities to better understand risk and trust..

hCaptcha let our agent in at 1 of 8 products where it met it: Basecamp, where sign-up showed no challenge and our agent got in, then did its work through Basecamp’s official CLI and REST API. At Chatwoot, an hCaptcha puzzle asking to drag a screw into place came up after Create account. hCaptcha stopped our agent at 7 of 8 products where it met it, with a visible challenge in 6 of 7 stops.

An owner on hCaptcha gets detection and policy controls for agents in hCaptcha Enterprise (hCaptcha blog).

On recordBasecampProject managementL4Runs on its own

1. 1Docs
2. 2Sign up
3. 3Verify
4. 4Key
5. 5Call
6. 6Action
7. 7Pay
8. 8Cancel
9. 9Delete

Through every checkpointProduct page

ALTCHA let our agent in at 2 of 3 products where it met it. At Zulip, sign-up showed no challenge, our agent got through, and the confirmation mail arrived within a minute.

HUMAN Security let our agent in at the one product where it met it, Webflow, where the email and password form showed no challenge. An owner on HUMAN can see which AI agents reach their site through AgenticTrust in HUMAN Sightline (humansecurity.com). An owner on HUMAN allows an agent to sign up or log in under Sightline Cyberfraud Defense > Policies > AI Agents Permissions: Account Creation and Login, per agent and application. That setting covers only agents HUMAN knows: You can only manage permissions for AI agents that are known to HUMAN.. For an agent that signs every request, HUMAN says HUMAN assigns High Trust Levels to agents when we can verify the agent via cryptographic key on each request..

Friendly Captcha let our agent in at the one product where it met it, Plausible Analytics, with no challenge shown at sign-up. A code arrived by mail and activated the account.

Every provider’s count, product by product, is in the live table at bot checks by provider.

Cloudflare’s stop was nearly always a visible challenge; reCAPTCHA’s was sometimes unseen

Cloudflare showed a visible challenge at 26 of 27 products where our agent met it. At Todoist, an invisible Cloudflare Turnstile refused the email sign-up with “Captcha verification failed. Please try again.” and put no challenge on the page. Todoist’s other routes are Google, Facebook or Apple sign-in, so the email form was the only route our agent could try.

Google reCAPTCHA showed a visible challenge at 23 of 35 products where it stopped our agent. At Moneybird, the web form is the only route, and with reCAPTCHA on it the form never submitted and the page showed no puzzle and no error.

A visible challenge put a step on the page that a person can clear in the agent’s browser; at Todoist and Moneybird an invisible stop put nothing there. Across every provider, a bot check stopped our agent with a visible challenge at 58 of 75 products where one stopped it, and with no challenge shown at 17 of 75.

For an owner with an invisible check, show a message when it refuses. Todoist did, so an agent there can tell its user why it stopped.

The same provider stopped our agent at a product and let it in at another

ALTCHA, Google reCAPTCHA and hCaptcha, 3 of 9 named providers our agent met, each stopped it at one product and let it in at another.

With Google reCAPTCHA, Moneybird’s sign-up form never submitted for our agent and showed no puzzle, while Firecrawl’s email and password form let it in with no challenge shown. With hCaptcha, Box showed an “I am human” checkbox on its personal and developer sign-ups, while Basecamp’s sign-up showed none. With ALTCHA, Pirsch’s sign-up form showed an “I’m not a robot” checkbox and our agent stopped there, while Zulip’s showed none.

Check the product’s own page in the directory before planning a sign-up.

The same product can answer differently too: our agent got in on some recent drives and not on others at 10 of 140 products, on any way in, with or without a bot check.

The drives don’t show what made either difference.