Astra 非机器人验证 48 关全通，再见 reCAPTCHA！
Ranking
No observed public metrics; popularity remains neutral/archived.
Merged summary
TL;DR - OpenAI’s GPT-6 Astra reportedly completed all 48 levels of a CAPTCHA-style GUI challenge, demonstrating stronger visual grounding, state tracking, and closed-loop computer control. The result weakens visual puzzles as bot defenses but does not bypass modern server-side verification, browser-risk analysis, or cryptographic agent authentication.
- Astra combines screen perception, coordinate grounding, action execution, and post-action validation; reported benchmarks include 92.7% on ScreenSpot-Pro and 72.6% on OSWorld 2.0.
- The 48/48 demonstration is not a rigorous pixel-only benchmark because its complete harness and possible access to page structure were not disclosed.
- Modern systems such as reCAPTCHA v3 and Turnstile also evaluate browser, network, behavioral, token-expiry, and server-side signals that a GUI agent cannot defeat merely by solving visible challenges.
- As legitimate agents increasingly access websites, security may shift from human-versus-bot classification toward cryptographic machine identity, delegated permissions, and fine-grained authorization.
Sources (1)
Astra 非机器人验证 48 关全通，再见 reCAPTCHA！
TL;DR - OpenAI’s GPT-6 Astra reportedly completed all 48 levels of a CAPTCHA-style GUI challenge, demonstrating stronger visual grounding, state tracking, and closed-loop computer control. The result weakens visual puzzles as bot defenses but does not bypass modern server-side verification, browser-risk analysis, or cryptographic agent authentication.
- Astra combines screen perception, coordinate grounding, action execution, and post-action validation; reported benchmarks include 92.7% on ScreenSpot-Pro and 72.6% on OSWorld 2.0.
- The 48/48 demonstration is not a rigorous pixel-only benchmark because its complete harness and possible access to page structure were not disclosed.
- Modern systems such as reCAPTCHA v3 and Turnstile also evaluate browser, network, behavioral, token-expiry, and server-side signals that a GUI agent cannot defeat merely by solving visible challenges.
- As legitimate agents increasingly access websites, security may shift from human-versus-bot classification toward cryptographic machine identity, delegated permissions, and fine-grained authorization.