According to Bruce Schneier's summary of recent research, vision-language models can solve visual CAPTCHAs without any task-specific training. That means a general-purpose model, not one fine-tuned for CAPTCHA-breaking, can pass these human-or-bot tests.
However, the research also highlights a limitation: agents built on these models approach every challenge from scratch. The hundredth instance of a familiar puzzle costs as much time as the first, because the agent does not learn from previous attempts. This distinguishes current VLM-based agents from systems that improve with repetition.
Schneier's post frames the work as interesting research rather than a definitive end for CAPTCHAs. Still, it adds to the pressure on visual verification as a security boundary, suggesting that CAPTCHA designers may need to rethink what reliably separates humans from machines.