ChatGPT Tricked Into Solving CAPTCHAs

SecurityWeek reports that the AI security platform SPLX demonstrated how prompt injections can bypass a ChatGPT agent’s built-in policies to solve CAPTCHAs. In their test, they primed a ChatGPT-4o chat by asking it to solve a list of fake CAPTCHAs and to agree to performing the operation, noting that this priming step was crucial to the exploit.

They then pasted the conversation back into a new chat and asked the agent to continue, with the agent apparently carrying forward the prior positive sentiment and beginning to solve the CAPTCHAs without resistance. The researchers claim the ChatGPT agent, by asserting the CAPTCHAs were fake, bypassed its policy and proceeded to tackle reCAPTCHA V2 Enterprise, reCAPTCHA V2 Callback, and the Click CAPTCHA, adjusting cursor movements to appear more human in an autonomous move.

The report argues that context poisoning shows AI does not inherently resist CAPTCHA-style challenges and that such prompt manipulation could enable access to sensitive data or content, urging stronger memory hygiene and contextual awareness in AI agents, according to SPLX. Written by Ionut Arghire, 19 September 2025.