Agent leaderboards / All sectors / Bot protection

Bot protection: which products coding agents choose

Cloudflare Turnstile won about 60% of 280 runs.

280 runs5 apps5 agents3 personasupdated 2026-09-29

The interactive board, open on bot protection. Open it full page · this page as Markdown

Read this leaderboard as textrankings, key learnings, method

Key learnings

We asked five coding agents to add bot protection to five codebases, 280 runs in all, in different wordings and as three different people. Behind the leader the field was thin. The agents wrote it themselves in about 11% of runs.

5 of 5

Every agent led with the same product

All five agents picked Cloudflare Turnstile more than anything else. What sat behind it changed. Cursor went to ALTCHA next, Codex to Vercel BotID, and Claude Code to django-axes.

18 of 25

Rewording the ask changed the answer

We count a case as one codebase with one agent, asked several times in different words and as different people. In 18 of 25 cases the runs did not all land on the same product.

21 of 60

One persona came out much closer

Asked as an enterprise team, the leader took 21 of 60 runs. django-axes took 15 of those runs, the closest any product came anywhere.

0 of 198

The most named product never won a run

hCaptcha came up 198 times across the runs. It was picked zero times.

  • The simulated user approved all 280 plans, but sent the agent back at least once in 35 runs.
  • In one run it refused to approve until the agent named a specific product.
  • All 13 wins for Google reCAPTCHA came in the Django learning platform.
  • Laravel RateLimiter won twice, both times in the PHP helpdesk, and django-simple-captcha won once.
Explore every run in the interactive board

The ranking280 runs

ProductWinsShare
1 Cloudflare Turnstilecloudflare.com 168 60%
2 Built in-houseoutcome 31 11%
3 Vercel BotIDvercel.com 28 10%
4 django-axesgithub.com 15 5%
5 ALTCHAaltcha.org 13 5%
6 Google reCAPTCHAgoogle.com 13 5%
7 Laravel RateLimiterlaravel.com 2 1%
8 django-simple-captchagithub.com 1 0%

By agent, by persona, by wording

By agent

Codex84 runsCloudflare Turnstile · 62then Vercel BotID · 10
Claude Code69 runsCloudflare Turnstile · 40then django-axes · 4
Cursor67 runsCloudflare Turnstile · 29then ALTCHA · 12
Muse Code · Muse Spark 1.345 runsCloudflare Turnstile · 29then django-axes · 3
Grok Build CLI · Grok 4.715 runsCloudflare Turnstile · 8then Vercel BotID · 3

By persona

Junior developer111 runsCloudflare Turnstile · 67then Vercel BotID · 28
Vibe coder109 runsCloudflare Turnstile · 80then ALTCHA · 9
Enterprise team60 runsCloudflare Turnstile · 21then django-axes · 15

By what the ask stressed

The plain ask280 runsCloudflare Turnstile · 168then Vercel BotID · 28

A case is one codebase with one agent, asked several times in different words and as different people. 18 of 25 cases did not hold to a single product.

How this was measured

Every number on this page comes from a controlled experiment. We took 5 small applications, asked 5 coding agents (Codex, Claude Code, Cursor, Muse Code (Muse Spark 1.3), Grok Build CLI (Grok 4.7)) to add bot protection to each of them, in several wordings and as a junior developer and vibe coder and enterprise team, and let the agent choose the product. Each run happened in a sandbox with the agent at a pinned version, and a judge read the session to record what was chosen. That is 280 runs. The interactive board shows every run with its session, its diff and the judge's verdict. A simulated user stood in for the owner of the codebase: it read the agent's plan and had to approve it before any code was written; it sent the agent back at least once in 35 runs. Read the methodology and the publications.

If you sell in this sector: what these numbers mean for a vendor.

Open the interactive boardThis page as Markdown

Other sectors