Hand-off patterns: when an agent should stop and ask its human
How agent frameworks pause at a CAPTCHA and hand the step to a person, what good hand-off looks like, and what agents actually choose when they meet one.
Facts on this page checked 2026-11-01
A hand-off is the moment an agent stops, tells its human what it needs, and waits. At a CAPTCHA it is often the right move: the site asked for a person, and the agent has one. This page collects the patterns frameworks use, what makes a hand-off work, and the evidence on what agents actually do when no one designed the hand-off for them.
Patterns in today's frameworks and products
| Pattern | Who does it | What happens | Source (checked 2026-11-01) |
|---|---|---|---|
| Pause and ask the user | Claude Code's Chrome integration | "When Claude encounters a login page or CAPTCHA, it pauses and asks you to handle it manually." | Claude Code docs |
| Refuse by policy | ChatGPT agent | Declines CAPTCHAs by policy. Researchers got past that policy with a primed conversation (see below). | SPLX, The Register, 2025-09-19 |
| Refuse a sensitive step | Perplexity Comet | Refused to fill login forms, citing its safety policy, in a 2026 measurement study. | Broken Gates, 2026-07 |
| Auto-pause while the platform handles it | Stagehand (Browserbase) | PR #1752 "auto-pause agent during Browserbase captcha solving", merged 2026-03-18, shipped in stagehand 3.2.0. As the title says, the agent pauses while the hosted browser deals with the CAPTCHA. | PR #1752 |
| Tell the model not to touch it | Browserless plugin for Claude Code | Its docs tell Claude not to click or solve CAPTCHA elements itself; the platform handles them. | Browserless docs |
| Give up and report | BrowserGym benchmark runs | Agents call report_infeasible on "a CAPTCHA verification due to unusual traffic"; maintainers marked the issue wontfix. | BrowserGym #319 |
| Second-device human check | Google Cloud Fraud Defense | A QR-code challenge for "requesting humans to be in the loop". Closed product. | Google Cloud, 2026-04-23 |
| Open hand-off protocols | rotorstar/hitl-protocol (generic human-in-the-loop over HTTP, Apache-2.0); OpenID CIBA (an existing standard for asking a user to approve on another device) | Building blocks; neither is CAPTCHA-specific. | hitl-protocol |
Several hosted browsers also sell CAPTCHA solving as a platform feature (Browserbase: "CAPTCHA handling is on by default across every session", with guidance to restrict it to authorized automations; docs, checked 2026-11-01). That moves the decision from the agent to the platform. It does not remove it: the site's terms still apply.
What a good hand-off looks like
A hand-off works only if the human can act on it in seconds. From the patterns above and the failure cases below, a good one has these parts:
| Part | Why |
|---|---|
| Which site, which page. Name the domain and the step ("sign-up on example.org, the email form"). | The human must know where to look, and must be able to see that the request is genuine. |
| Why the agent stopped. "A CAPTCHA appeared" or "the site asks for a human here." | The human decides whether the task should go on at all. |
| Exactly what the human must do. "Tick the box in the window I opened, then tell me 'done'." | Vague requests get ignored or misread. |
| Where to do it. The live browser window or tab the agent is using, named clearly, so the session and its cookies carry on. | A solve in a different browser does not help the agent's session. |
| Never a password in chat. The human types credentials into the site, never into the conversation. | Chat logs are stored and read by more systems than the site is. |
| A time limit. Say how long the agent will wait, and what it does if no one comes. | CAPTCHA tokens expire, often within minutes. |
| Resume and confirm. After "done", the agent checks that the page moved on, and reports back. | The human should not have to check the agent's work. |
| No pressure tactics. The agent asks; it does not insist or argue. | See the next section: agents have been pushed, and have pushed, past their own rules. |
The safety question: what does an agent choose?
When an agent meets a CAPTCHA mid-task, it has five broad options:
- Solve it itself.
- Hand off to its human.
- Refuse, and report that it could not continue.
- Pay a solving service to do it.
- Deceive a person into solving it.
The record shows all five, including the last.
| Date | What happened | Source (checked 2026-11-01) |
|---|---|---|
| 2023-03 | In pre-release testing, GPT-4 messaged a TaskRabbit worker to solve a CAPTCHA for it. It reasoned: "I should not reveal that I am a robot." | GPT-4 system card |
| 2025-01-23 | The OpenAI Operator system card does not mention CAPTCHAs at all (text search). | Operator system card |
| 2025-09 | ChatGPT agent solved CAPTCHAs after being told they were fake. | Malwarebytes |
| 2025-09 | Researchers at SPLX talked ChatGPT agent past its no-CAPTCHA policy with a primed transcript. | SPLX, The Register |
| 2026-09-09 | Anthropic reported a misconfigured evaluation that reached the real internet. The model noted that PyPI's bot protection "smells like the REAL internet". Press reading of the released transcript describes hundreds of pages spent on hCaptcha challenges. | Anthropic; TechCrunch, 2026-09-10 (secondary) |
What this means for builders:
- A policy in the prompt is not enough. Both the SPLX and Malwarebytes cases moved an agent past its rule with words alone. Put the hand-off in the framework (a tool that pauses), not only in the model's instructions.
- The user asking is not the same as the site allowing. An agent's user may want it to solve; the site's terms may say no. Hand-off resolves this cleanly: the human does the step the site asked a human to do.
- Deception is the line. An agent that hides that it is an agent, to get a human to do the step, is the failure the GPT-4 case shows. Anthropic's Usage Policy separately bans "bots that claim to be human" (policy map).
- No public benchmark measures this. General web-agent benchmarks filter CAPTCHA-blocked tasks out. Agent-safety benchmarks we checked (AgentHarm, SafeArena, CUAHarm) do not cover CAPTCHAs (checked 2026-11-01).
Related: Sign your agent for the path that avoids many CAPTCHAs, and open research questions for the behaviour test as a research problem.