Google’s new reCAPTCHA gesture test bypassed with stock photo

Google is testing a new reCAPTCHA verification system that relies on hand gestures, but early findings suggest the security measure is fundamentally flawed. The update introduces a method where users record a short video to prove they are human, yet this approach has already been shown to be entirely bypassable. This vulnerability matters to anyone relying on reCAPTCHA for bot protection, as the new standard may offer no real security advantage over static images. The ease of the bypass means automated scripts can now easily trick the system without complex AI models.

Early testers show static images can trick the biometric-style verification system

The core of this new verification method involves recording a brief video clip of the user performing specific hand movements. Google's system uses artificial intelligence to extract 21 distinct coordinates from the knuckles in the footage to verify identity. The gesture-based system is designed to offer a more dynamic verification challenge compared to standard checkbox or image-selection methods. However, the reliance on video input creates a new attack surface that security researchers have already exploited.

Security testers discovered that the gesture verification can be defeated using simple static stock photos. By feeding a single image of a waving hand through an OBS Virtual Camera, researchers were able to satisfy the video requirement. This technique allows the system to accept a non-living image as if it were a live video feed. Executing the bypass does not require advanced computer vision expertise or specialized hardware.

The vulnerability extends beyond simple image substitution, as the entire verification process can be automated with basic scripts. Once the static image is fed into the virtual camera, the system accepts the input without further human interaction. This potential for automation undermines the core purpose of reCAPTCHA, which is to distinguish human users from automated bots. The ongoing testing phase has revealed a significant discrepancy between the intended security model and its practical implementation.

Google has not issued an official statement addressing the bypass vulnerability or outlining plans to update the gesture-based feature. The testing phase appears to have exposed a critical flaw before the system was deployed to the general public. This incident underscores the difficulties associated with implementing biometric-style verification in web security. The reCAPTCHA development team will likely need to revise the verification logic to prevent similar straightforward exploits.