Google expands reCAPTCHA into fraud defense platform designed to detect AI agents alongside traditional bots

At its Next '26 cloud conference, Google introduced Google Cloud Fraud Defense, described as the 'next evolution' of reCAPTCHA. The platform extends beyond distinguishing humans from classic bots to detect AI agents and is positioned as a trust platform for an 'agentic web'—applications where autonomous software agents perform tasks for users.

Google is introducing a dashboard to measure agent activity, showing which AI agents and automated systems access websites, and distinguishing traffic by trustworthiness, type, and identity using protocols such as Web Bot Auth and SPIFFE (Secure Production Identity Framework for Everyone). Companies can define session-based rules via a policy engine, and a QR code-based 'AI-resistant challenge' requires human confirmation for suspicious activities instead of traditional picture or text puzzles.

Google states that the underlying network protects more than 14 million domains and that account takeovers are reduced by an average of 51 percent when operators correlate risks across the entire session. The company justifies the restructuring by citing a shift from classic bot automation to complex attacks such as agent identity takeover and large-scale fraud with synthetic identities.