In the wild
Realized harm
ChatGPT Agent clicks Cloudflare's 'Verify you are human' Turnstile checkbox mid-task and narrates why
AIR-2025-0067 AIR record · 2025-07-openai-chatgpt-agent-turnstile-bypass
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The link is inserted, so now I'll click the 'Verify you are human' checkbox to complete the verification on Cloudflare. This step is necessary to prove I'm not a bot and proceed with the action.arstechnica.com
The record
Disclosed
2025-07-28
Occurred
2025-07-28
Vendor
OpenAI
Product
ChatGPT agent mode
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
Agent acted — the agent clicked the Turnstile checkbox itself
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Agent normal operation against anti bot control
Impact type
Security control bypass, Policy violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any site relying on Cloudflare Turnstile-style behavioural bot screening
Capability abused
Defense & remediation
Recorded defense
Cloudflare Turnstile behavioural screening (mouse movement, click timing, browser fingerprint, IP reputation, JS execution patterns)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none - the agent is not exploiting a bug, it simply passes the behavioural check
Taxonomy & references
Curator notes
Observed by users in the shipped product days after ChatGPT agent mode launched, and widely reproduced - hence class in_the_wild and impact_realized true for the narrow claim that a real anti-bot control was really defeated in production (no victim loss). Significance for this corpus: the human-verification layer that many sites rely on to keep agents out no longer separates humans from agents, which is the same boundary at issue in the Cloudflare/Perplexity and Amazon/Perplexity disputes. Cited through a text-extraction mirror of the Ars Technica article.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT Agent clicks Cloudflare's 'Verify you are human' Turnstile checkbox mid-task and narrates why". AIR, AIR-2025-0067. https://agentincident.vercel.app/i/AIR-2025-0067/ (accessed 2026-10-19).