You’ve probably seen it before: a website asks you to prove you’re human by clicking a checkbox, solving a puzzle, or typing wobbly letters. But what if the real test isn’t whether you can do it—but whether you will?
That’s the premise behind a bizarre little experiment called Human Honeypot. Visit human2llm.pages.dev, and you’re greeted with a simple message: “FOR HUMANS ONLY.” Then come the instructions: fetch a JSON file, parse it, POST a checkout payload, and retain your ticket ID. It’s a multi-step API workflow—the kind of thing a developer would automate with a three-line script.
But here’s the punchline: the counter at the bottom reads “HUMANS WHO TRIED CHECKOUT: 000000000.” Zero. Not a single human has bothered.
And yet, bots? They’re crushing it. The site logs show automated agents have completed the task dozens of times. They didn’t hesitate. They didn’t sigh. They just did exactly what was asked.
The irony is so thick you could cut it with a JSON parser. The test designed to keep machines out has become a test of who is willing to act like a machine—and humans are failing.
Let’s sit with that for a second. We’ve been taught that CAPTCHAs separate humans from bots by measuring something uniquely human: pattern recognition, emotion, creativity. But the Human Honeypot flips the script. It measures patience. It measures tolerance for repetitive, mechanical tasks. And on that metric, bots are overwhelmingly superior.
Why? Because humans are lazy. We have better things to do. We scroll past the “prove you’re human” boxes with a sense of entitlement—“I’m obviously human, why do I have to jump through hoops?” But a bot has no ego. It has no sense of time. It executes instructions without complaint.
This is not a bug. It’s a feature of the AI age. As more agents roam the web, the cost of friction shifts. Bots treat every click as a free lunch. Humans treat every extra step as a tax on their attention. The result? Patience is the new Turing test.
Now, before you dismiss this as a cute trick, think about the implications. Every website that uses friction to block bots—login forms, multi-factor authentication, “I’m not a robot” checkboxes—is actually optimizing for bots. They’re saying: “We will tolerate your inconvenience because we assume you’re human.” But the Human Honeypot proves that assumption is backward. The more friction you add, the more likely a human will bounce—and the more likely a bot will persist.
I saw this firsthand when I tried the checkout myself. I opened the terminal, copied the URL, and… stopped. I thought, “Do I really need to do this? I’ll just read the article instead.” I was too lazy to prove I was human. The bot, meanwhile, had already completed the task and moved on to the next one.
We’ve built a web where the most reliable indicator of humanity is the willingness to act inhumanely. That’s not a flaw in the design—it’s a flaw in our self-image. We think of ourselves as the creative, spontaneous species. But the web rewards the opposite: consistency, obedience, and a complete lack of boredom.
So what do we do? The answer isn’t to make everything frictionless—that’s a bot paradise. The answer is to design for the humans we actually are: impatient, easily distracted, and deeply unwilling to do anything that feels like work. That means rethinking security, UX, and even the definition of “human verification.”
Or, as the Human Honeypot suggests, maybe the next CAPTCHA will be a simple question: “Are you willing to do something boring for 10 seconds?” If you answer yes, you’re a bot. If you say no—welcome, fellow human.
FAQ
Q: Isn't this just a niche trick that doesn't apply to real-world security?
A: It's a proof of concept, but the principle scales. Any friction-based 'human verification' that requires tedious, repetitive steps will be more likely to stop humans than bots. Real-world CAPTCHAs already rely on the assumption that humans are faster at pattern recognition—but as AI improves, that assumption crumbles. The Human Honeypot exposes a deeper truth: the most reliable bot filter may be human laziness itself.
Q: How should designers and security engineers respond to this insight?
A: Stop adding friction that assumes humans are patient. Instead, use friction that exploits human cognitive strengths—like surprise, ambiguity, or emotional context. Or, better yet, move to behavioral signals: how you move your mouse, how you scroll, your typing cadence. The worst thing you can do is build a system that rewards machine-like behavior, because you'll end up training humans to act like bots.
Q: Isn't human laziness actually a good thing? Why should we try to be more like bots?
A: You're right—laziness is often the engine of innovation. We automate chores because we hate repetition. But the problem is that many web interfaces are designed for the ideal human: one who reads instructions, follows steps, and never complains. That human doesn't exist. The contrarian take is: maybe we should accept that humans are lazy and design systems that don't test patience. Let bots do the tedious work, and let humans do the creative, unpredictable stuff. The future of the web isn't about making humans more machine-like—it's about making machines handle the machine-like parts.