55,000 fake signups in one night the post-mortem (and what finally worked)

A few weeks ago one of my products got hit with ~55,000 fake signups in a single night. I'm a solo founder, so it was just me at 2am watching the number climb.

Sharing the post-mortem because I couldn't find one when I needed it.

What did NOT work:

• CAPTCHA — modern bots and AI agents either solve them or drive real browsers that never trigger them. Friction for real users, stopped basically nothing.
• Email verification — they used real, catch-all, and disposable inboxes. Confirmed fine.
• IP rate limiting — spread across thousands of residential IPs. Useless on its own.

What actually worked:

• Behavioral signals. Real humans move a mouse and fill a form with messy, physical timing. Scripts — and even AI agents driving Chrome — don't reproduce that micro-physics. No puzzle, invisible to users.
• The tell that cracked it: agents driving a browser via CDP leak geometry artifacts (cursor coordinate alignment + "teleport" jumps) a human hand never produces.

What I learned:

1. CAPTCHA is theater against 2026 bots. Stop treating it as your wall.
2. The threat is AI agents in real browsers now, not curl scripts.
3. Measure behavior, not puzzles. The puzzle punishes humans; behavior catches machines.

I ended up building this into the product I run — happy to share the link if it's useful, but mostly I wanted to put the lessons somewhere findable. Anyone else seeing AI-agent signups lately?