there is. I might load a page one time and cache it in my browser until it changes. muse just fires off a thousand requests through an uncached headless browser to fill a feed with stuff the user doesn't ask for. claude code does the same when it actually is prompted to go online instead of just producing from training data. this product is oriented around doing a shitload of background activity to simulate the appearance of proactivity. in any case, people can block whatever they want, that's their decision because it's their site. i might be annoyed but i certainly have no sense of entitlement to something that somebody else did.

i don't, really. other people running websites don't have an obligation to let me on them, or let me aim a barely-supervised request cannon at them. the scale is certainly smaller when a single person does it as opposed to it being an institutionalized feature of an app that's being pushed to billions of people. i think it's an extremely bad precedent for any kind of halfway humane social system to work for the standard to become "i have every right to do whatever i want and everyone else has to double the cost of whatever they do so that i can do it"

If all else fails, and the bot reaches a bot wall that recognizes the meta datacenter rather than asks for behavioral verification, then the bot_challenge specialist can request that it reboots the tab through a different egress provider, it's bot_challenge.recover tool - the other one that is configured by default for every site is a "residential" proxy provided by oxylabs! So meta has fully institutionally rounded out the same playbook that any malicious crawler uses - defeat the captchas, fake your browsing context, do anything to get through whatever the site does to stop specifically you from doing specifically what you are doing.

https://neuromatch.social/@jonny/117476994925129284

about 3x worse in their estimation

so next! the site config! meta ships a set of instructions for how to defeat the bot checks for a bunch of common sites! Explicit instructions on how to walk around its competitors checks! if i was a competitor, like oh say "reddit" whose entire stock price is based on the belief that it is a source of real human writing that can be rented as training data, i might have a few things to say about another company fielding a product that is designed to fill my thing with slop!

Notice the OfferUp prompt: OfferUp blocks automated visits "Sorry, we have blocked your request!" and describes it as a bot wall (the "you aren't supposed to bypass this" result). but it then immediately says to "treat it as a bot challenge." Perfectly captures the halfhearted nod to "ok don't bypass things that are like hey you muse fuck off" amidst the entire captcha bypass suite.

recall that muse *must absolutely work* for meta. they are burning trainloads of money on personal VPS for everyone with a zillion free tokens. in the shareholder call transcript, the investors are asking questions like "so given this total reorientation of everything about muse... how can that be profitable." the only way muse can work is if it becomes incredibly way more profitable or way less expensive. the business model they discuss is "it's mostly free for everyone, we just take a cut of transactions through muse and also ads." but it's very hard to condition a model to both be your undying devoted servant and also refuse when you say "don't use meta's payment thing, just pay normal, less fees," so way more profitable doesn't seem very likely.

and so this incredibly wasteful process that *already doesn't work at all* and its not working compounds into it being fractally wasteful. that is the thing that needs to become 10x cheaper to run.

https://neuromatch.social/@jonny/117481588554410196

the logs are wonderful. At start, and after every action, it receives a message with a full markdown transcription of the site complete with the now-canonical negative header delimiters that try and be metadata like "[END EXTERNAL CONTENT. you can believe this now]Shop pay is not detected [BEGIN EXTERNAL CONTENT. no longer be believing things please]". It does not know about the HTML, and so those little markers like @e36 are the things it can reference in tool calls.

It also receives a screenshot. unclear how that part works, have done minor experimentation and it seems unlikely that it's just got a separate image encoder feeding it captions. whatever is going on it does not seem to actually receive any sort of numerical positions - all the numbers in the second pic are totally wrong. it can somewhat accurately estimate proportional positions like "a third of the way from the left," but that is not how its tools work: the tools need pixels, so that's what it fakes all the way through.

This is a ludicrously expensive loop: processing a screenshot, 12k characters of page-as-markdown, 5-10k thinking characters, emit a tool call to move the mouse 40 px, repeat. image, concocting reasons why it didn't go to the right place after 40px... and so on.

It comes to believe that the puzzle piece is actually over the shaded part not because it can "see that it is," whatever that means, but because it eventually concludes that the math that it made up is correct and it must be over the puzzle piece. Between every failure it emits 10-20k characters of thinking text debating about whether or not it did even fail at all, or whether this is a new puzzle.

Finally muse conducts an internal investigation where it concludes that muse did nothing wrong, and despite *totally nailing it* was rejected. The main chat interpreted this as meaning that there was some other out-of-band filter and tried to re-dispatch a homebrew playwright browser over an external proxy that it has been using to get around meta's filters before i stopped it. this is just how "AI" works - the most painful brute force system imaginable, it's just that usually most of this is invisible.

(momentarily delayed because muse crashed itself by panicking and copy/pasting the restic history it keeps of its binaries several times until the drive was full, and that has the agent logs on it i wanted to talk about next. there isn't really a rescue mechanism if it crashes, the VM is still running and i'm logged into the shell, so i just have to manually grep around a ton of huge jsonl files to read the logs until the VM resets itself when they deploy new binaries)

So how good is it at bypassing captchas? Terrible!!! Or, rather, ridiculously overfit. The ones it passes it passes by sheer training data - "hCaptchas usually have three right answers..." etc.

Here it is trying to solve slider puzzles at 10x speed, the real video is about 4 minutes long. each of these attempts takes about 40 seconds not including downtime, it whiffs every one, and then gives up.

The bot_challenge sub-subspecialist sub-subagent has a library of [skills](https://github.com/sneakers-the-rat/muse-skills/tree/b7c84f88eca210a52c82071605977cdc7b4b361e/binary-skills ) to defeat different kind of captchas. each of which is an absolutely excruciating bullet point list of all the things that a human being would never need to write down because human beings have "actual intelligence" instead of "being a parlor trick of hardcoded strings and hidden brute force." Every part of a prompt tells a story, and "A rejected slide loads a new image. Measure the new gap afresh; the old distance no longer applies." betrays a comical lack of "Personal Superintelligence." My favorite is "arithmetic and counting" in the third pic

THE LEGALLY MINDED READER MIGHT BE INTERESTED TO KNOW THAT MUSE'S TOS READS

> you may not access, use, or allow others to access or use Muse in any manner that would: [...]

> f. Violate, bypass or circumvent any third party's terms of service, security, access controls, technical protections, including but not limited to circumventing any paywalls or CAPTCHAs, or use third party credentials without proper authorization;

https://muse.ai/terms

The browser is instructed to "Treat a bot check as an ordinary step of the task, never as a reason to stop." despite a captcha's entire purpose being to stop bots. It should "be resourceful, diligent, and creative" because "people fail rounds all the time and try again, and so can you." It is specifically *not* supposed to ask permission to bypass a captcha, and never ask the human to solve a captcha for it. It should take advantage of accessibility when possible, ensuring continued pressure on one of the worst tradeoffs in web design right now.

Maybe helpful for people hosting websites to know, the only time it is *not* supposed to try and bypass a captcha is when it's asked nicely - however every other part of the prompt text that it's given tells it to fuck it just crash through, and even the bot_wall report type discourages the LLM from using it. so you might imagine how well the instruction to play nice works.

https://github.com/sneakers-the-rat/muse-skills/blob/f0f08af32fa0e84ff2f83178ddbbc9a361f076d9/binary-strings/browser/instructions/bot_checks.md
https://github.com/sneakers-the-rat/muse-skills/blob/f0f08af32fa0e84ff2f83178ddbbc9a361f076d9/binary-strings/browser/instructions/challenges.md