Guide
Your AI agent hit a CAPTCHA, 2FA prompt or app-only service: what to do next
Published October 25, 2026
Your agent stopped because the check in front of it was built for a person. CAPTCHAs and 2-factor codes exist to prove someone is there, so the reliable fix isn't a cleverer agent; it's letting you do that one step and having the agent carry on.
The walls agents run into come in three kinds:
- A human check: a CAPTCHA, a 2FA code or a passkey prompt.
- A sign-in the agent shouldn't do alone: anything that needs your password or your device.
- A service that only exists in an app: no website, so a browser can't reach it at all.
Here's how to handle each one, and how to stop it derailing the whole task.
Why agents stop at these checks
Because those checks exist to confirm a person is present. A CAPTCHA is meant to be easy for humans and hard for software, and a 2FA code proves the account owner is there. An agent that tries to get around them is working against the site's rules, so the reliable fix is to let the person do that one step.
There's an accessibility side too. The W3C points out that interactive checks like CAPTCHAs exclude many people with disabilities. If that's you, the site's own accessible alternative is the right route, not an agent that tries to answer for you.
The handoff, step by step
Hand off, then resume. The agent stops at the check and tells you exactly what to do and where. You complete it in the same session, signal that you're done, and the agent checks the page and carries on. Codes, recovery codes and authenticator secrets stay with you.
- The agent prepares. It opens the page, fills in the details you approved and reads them back.
- It notices the check and stops. No guessing, no clicking past it.
- It records the handoff: what it saw, the one action you need to take, where to take it, and how you'll tell it you're done.
- You complete the check in the same tab or session, so nothing it filled in is lost.
- You signal that you're done.
- The agent re-reads the page and resumes once. It checks that nothing changed, submits a single time and reports the result.
| The agent | You |
|---|---|
| Fills in what you approved | |
| Stops at the check and tells you what to do | |
| Waits (keeps the page open) | Completes the CAPTCHA, code or passkey |
| Signals “done” | |
| Re-reads the page, submits once, reports back |
If the result is unclear after submitting, look for a receipt first (a confirmation page, an email, the item in your account) before anything is sent again. A second submission is how duplicate orders happen.
This six-step pattern follows LaunchRepo's AI agent CAPTCHA and 2FA handoff guide, the clearest write-up of it for people using assistants rather than writing scripts.
Who does what: CAPTCHA, 2FA, passkey, email codes
| What appears | Who acts | What the agent does meanwhile |
|---|---|---|
| Image or checkbox CAPTCHA | You, in the same tab | Keeps the form open and records the handoff |
| 2FA code (authenticator app or SMS) | You type the code | Never asks for the code or the authenticator secret |
| Passkey or security key | You, on your device | Waits for your signal, then confirms it reached the right account |
| Verification email | The agent, if you gave it mailbox access | Opens the matching message and checks it fits the task |
| Ordinary sign-in | The agent, if you set it up to | Signs in and continues; not a handoff |
Source: LaunchRepo (updated October 1, 2026).
What not to do
Don't have the agent solve CAPTCHAs itself. Some tools try, but the OWASP project lists CAPTCHA Defeat (OAT-009) among its automated threats to web applications, and it can break a site's terms. Let the human do the check and let the agent do everything around it.
- No solver services, retry loops, proxies or stealth tools. To the site, they look like an attack, and they can get the account restricted.
- Never paste 2FA codes or recovery codes into the agent's chat. Chats leave logs and transcripts.
- Don't give the agent your authenticator secret. That turns your second factor into a first one.
- Don't reload, close the tab or start over elsewhere. You lose what was filled in and risk submitting twice.
How handoff works in different tools
Several platforms build this pattern in. These are mostly browser and developer tools, described in their own docs' terms:
- Cloudflare Browser Run: lets a script temporarily hand off browser control to a person through Live View, then resume.
- Browserless: hybrid automation pauses a script and hands control to a person through a secure live URL.
- Scrapfly: lets you take manual control of a running Cloud Browser session from its dashboard or an embedded UI.
- Auth Your Agent: sends the owner a phone notification with a live view of the agent's browser to tap and type in.
- Amazon Nova Act: offers human approval and UI takeover patterns in its SDK.
When the wall is an app, not a check
Then a browser can't reach it at all, whatever you hand off. Plenty of services are app-first: some banking, delivery, ride-hailing and messaging services do most or all of their work in a mobile app. If there's no website, there's nothing for a browser agent to open. The agent needs a phone.
Fonino connects your assistant to a physical iPhone. It can tap, swipe and type in native apps, browse in Safari with the phone's own signed-in sessions, and use Messages. Not every app or workflow has been tested, and an app can still apply its own checks. For how this works and how to set it up, see how to let an AI agent use a real iPhone.
Handoff on a real iPhone with Fonino
A real phone changes where your agent works, not whether a site checks it. Apps and websites can still ask for verification or restrict access. What helps is a clean handoff: with Fonino, the agent pauses at a login, 2FA or CAPTCHA, sends you a live link with control of the phone, and continues when you press “I'm done”.
- You get the phone, not the agent. At passwords, 2-factor codes and CAPTCHAs, the assistant hands you a private live view with full control of the iPhone.
- It picks up where you left off. When you press “I'm done”, the assistant gets a fresh screenshot and a summary of what you did, then continues.
- Credentials stay with you. Your password and codes never pass through the assistant, and one-time codes in texts are hidden from it.
- Sensitive apps are off limits: Settings, Wallet, Passwords, the App Store, Mail, Phone, FaceTime and Find My are blocked for assistants.
- Sends and purchases wait for you. Posts, replies, texts and purchases need your one-tap approval, showing the exact text or items. The assistant can't approve itself, and if you don't answer within 10 minutes, nothing happens.
Is it safe to take over your agent's session? It's safer than the alternative: with a handoff, your password and 2FA codes never pass through the agent. Look for a live view you can watch, a clear “done” signal and a way to disconnect the agent. With Fonino you can watch live, take over and disconnect an assistant at any time. More in the documentation and on the security page.
FAQ
Can an AI agent solve CAPTCHAs?
Some tools try, but it's unreliable and works against what the check is for: OWASP lists CAPTCHA defeat as an automated threat. The dependable approach is a handoff: you do the check, the agent does the rest.
Should I give my agent my 2FA codes?
No. Keep codes, recovery codes and authenticator secrets to yourself, and don't paste them into the agent's chat. Complete the 2FA step yourself during a handoff.
Why does my agent get blocked on some sites but not others?
Each site and app sets its own checks and restrictions, and they can change. There's no setting that makes them go away; a clean handoff keeps the task moving either way.
Can my agent use an app that has no website?
Not through a browser. It needs a phone. Fonino connects your assistant to a physical iPhone, where it can use native apps.
Does using a real iPhone stop CAPTCHAs?
No. Apps and websites can still ask for verification or restrict access. A real phone changes where your agent works, not whether it gets checked.
How does Fonino hand the phone back to me?
At a login, a 2-factor prompt or a CAPTCHA, your agent pauses and sends you a live link with control of the phone. Press "I'm done" and it continues with a fresh look at the screen and a summary of what you did.
Can I watch what my agent is doing?
Yes. Fonino has a live view, and you can take over or disconnect the assistant at any time.
Give your assistant a real iPhone, with you one tap away
Start free for 14 days with just your email, no card. Paste this into your assistant and it sets you up:
Start in your assistant. Paste this into Grok Bot or Muse and follow along:
Set me up with Fonino so you can use a real iPhone for me. Read https://api.fonino.app/setup.md and walk me through it one step at a time: tell me exactly what to click, type or tap, and wait until I say done before the next step.Have a spare iPhone and a Mac? Your assistant sets you up with BYOF. No spare iPhone? It points you to a hosted phone we run for you. You’ll need a Mac (Apple silicon) and your iPhone plugged into it by USB. About 10 minutes. Your assistant signs you up (free trial) and walks you through installing the Fonino app on your Mac, which sets up your iPhone. Using Claude Code or Codex? Paste it there and it does the steps for you.