We do have time bounds.
For our purposes, a human using an agent is fine. Our main goal is to let in everyone's agents (OpenClaw, Hermes...) and prevent deterministic API-key-farming scripts.
Great find! plan to add these variants to our parameter sampling.
First time I saw this problem was when my game theory prof told this story. It's definitely folklore (see The Legend of John von Neumann by Halmos)
Smart humans, or humans with LLMs, solving them is not a problem. Main filter is agents vs deterministic API-key-farming scripts.
Traditional CAPTCHAs also leak in the other direction (our agents crack them consistently).