It’s a pretty common occurrence on the internet: You go to make a purchase, but before you do, you have to prove you’re a human by selecting how many pictures in a three-by-three grid contain bikes. Other times, you only have to check a box affirming — seemingly just on faith — that you’re a human.

These things are called CAPTCHAs, the acronym for “completely automated public Turing test to tell computers and humans apart,” and they’re designed to block spammers or other bad actors from a website. But as AI becomes more sophisticated, that industry is growing to match it. “It’s a big business,” said journalist Justin Pot, who wrote about CAPTCHA for The Atlantic.

The Google-owned system reCAPTCHA is the industry leader, but according to Pot, it makes an interesting case study. “They’re less and less focused on the CAPTCHA, and they’re just kind of monitoring what you do on a website to try to identify how you’re behaving,” he said. “And if you’re acting in a way that seems suspicious, then the CAPTCHA shows up. But otherwise, sometimes you see the CAPTCHA that’s just a checkbox. And it says, ‘All good. You’re human.'”

“Marketplace” host Kai Ryssdal spoke to Pot about the CAPTCHA industry. The following is an edited transcript of their conversation.

Kai Ryssdal: It used to be back in the day — and look, these things have been around for 20-something years, you write — it was just a bunch of letters, maybe in a different font or capitals. Tricky things that you would have to figure out. And now, it is different because, why?

Justin Pot: Basically, because computers got better at solving them. Initially, those letters that you’re identifying were actually little excerpts from books. So Google owns one of the biggest companies in this field, which is called reCAPTCHA. And they found little bits of texts that a computer struggled to figure out which letters they were. And they would be fed in the CAPTCHA, and this had two purposes: It would help identify you as a human, and it would also help the AI learn how to identify letters better. It got better and better at it to the point where the humans weren’t needed anymore, and that made it no longer work to detect who is human. So they had to pivot to images, and now the images are starting to not work too.

Ryssdal: Well say more about that, right? Because we’ve all heard about AI and it’s getting smarter. And there’s a version of AI that can basically see now, as you say this piece, so it’s not going to be too long before AI can, you know, see which of those nine squares has a traffic light in it. And then what happens?

Pot: I mean, you just have to keep thinking of new systems to check. Right now, there is one company that has people rotating frogs for reasons I can’t fully understand, but they say they’ve iterated against the AI. And for whatever reason, the AI struggles with that, maybe that will be solved later.

Ryssdal: Rotating frogs, we should be clear, you have to align the frog with the direction the arrow is pointing, right?

Pot: There’s an arrow on the screen to the left, and there’s a three dimensional image of a frog to the other side. And you’re supposed to rotate it so that it’s facing the direction of the arrow. It sounds easy. It’s not. I can’t do it.

Ryssdal: I love that you were stumped by this one. That made me chuckle. You mentioned a company. There is business opportunity in CAPTCHA, yes?

Pot: Yeah, it’s a big business. Google kind of dominates it, like I said before, but there’s a few businesses that offer kind of different kinds of products. Google’s kind of interesting because they’re less and less focused on the CAPTCHA, and they’re just kind of monitoring what you do on a website to try to identify how you’re behaving. And they kind of use that to judge, not if you’re human or not, actually; a company representative told me they’re more interested in what it is you’re trying to do. And if you’re acting in a way that seems suspicious, then the CAPTCHA shows up. But otherwise, sometimes you see the CAPTCHA that’s just a checkbox. And it says, “All good. You’re human.” That’s what’s happening there. They’ve been watching you.

Ryssdal: Well, that’s slightly terrifying.

Pot: It’s slightly terrifying. And some people don’t like that from a security standpoint. There’s another company called hCAPTCHA, and they offer a similar CAPTCHA service but they don’t do the tracking. Part of their whole thing is the privacy angle. So there’s that, but there’s also a big opportunity as the AI gets better. If someone can think of another way to identify who is and isn’t human, there could be a big business opportunity there.

Ryssdal: This is a bit grand for for the topic at hand, but sure, I think it’s reasonable. This is kind of what it means to be human right? Because that’s what we’re trying to demonstrate to the computers when we click on those freakin’ traffic lights in the nine grids.

Pot: Yeah, and that’s why I encourage people instead of getting frustrated when new variations of the CAPTCHA come up to maybe pay attention a little bit and think about what this says about what it means to be human. I, for one, don’t know what rotating a frog says about what it means to be human. But there’s clearly something there, because smart engineers have spent a lot of time determining that this is something we’re good at.