Google's new hand gesture CAPTCHA was fooled by a stock photo

In mid-June, Google began testing a new version of reCAPTCHA called Hand Gesture Verification.

Instead of asking users to identify traffic lights or decipher distorted text, the new system requests camera access and asks them to perform a simple gesture shown on screen, such as waving or raising an open hand.

A short video is then analyzed by AI. Google says the recording is processed only for verification and deleted immediately afterward. The goal is to make CAPTCHAs more resistant to increasingly capable bots.

Just weeks after the rollout, however, users found a surprisingly simple workaround. An X user demonstrated that the system could be fooled with a stock photo of someone raising their hand, streamed through OBS Virtual Camera, software that lets users replace their webcam feed with any image or video. The CAPTCHA accepted the image on the second attempt.

A Neowin journalist reproduced the test using several different stock photos. It took a few attempts and some repositioning of the image within the frame, but Google eventually accepted the static photo as a genuine hand gesture.