Presumably it’s something like N headless browsers all waiting to click “checkout” on a cart with a decoy item in it, then when the drop happens they all update their carts with the new item and then post checkout with your precreated captcha token.

That’s one way yes, that called precart. That’s a common but less sophisticated method than what’s available

Cool! Tell us about the other ways.

first rule of sneaker bot club..

Some capcha has this vulnerability. In general bots solve capcha faster than humans now

Even things like hCaptcha?

I think balko bot can solve in 2-3 sec now. It absolutely destroys Shopify.

Recaptcha sends the same image to multiple browsers at the same time and it gets solved by consensus I think.

You’re thinking of reCaptcha “v2”. That was when it was about digitizing books. One distorted photo of a word had a known spelling, and the other didn’t. If you spelled the known one right, it let you through. If enough people spelled the unknown one the same way, it would “learn” how to OCR that word (of sorts). If you had time to spare/waste, you could spell the first one right, and put garbage for the second one. About half the time, it would let you through.

Not sure how reCaptcha “v3” (the photos of streets one) works. It could work the same way, but just with more known and unknown (unclassified) pictures? It’s also a lot more harsh if you get it wrong: artificial delays, switching to the “click until no more remain” mode (with more delays), and more. Sometimes, it just refuses to let you through no matter what: https://youtu.be/zGW7TRtcDeQ It’s extremely frustrating.