ChatGPT Won't Let You Type Until Cloudflare Reads Your React State
by alberto-m on 3/29/2026, 8:21:05 PM
Comments
by: MyNameIsNickT
Hey! I'm Nick, and I work on Integrity at OpenAI. These checks are part of how we protect our first-party products from abuse like bots, scraping, fraud, and other attempts to misuse the platform.<p>A big reason we invest in this is because we want to keep free and logged-out access available for more users. My team’s goal is to help make sure the limited GPU resources are going to real users.<p>We also keep a very close eye on the user impact. We monitor things like page load time, time to first token and payload size, with a focus on reducing the overhead of these protections. For the majority of people, the impact is negligible, and only a very small percentage may see a slight delay from extra checks. We also continuously evaluate precision so we can minimize false positives while still making abuse meaningfully harder.
3/29/2026, 9:33:17 PM
by: lxgr
It's absurd how unusable Cloudflare is making the web when using a browser or IP address they consider "suspicious". I've lately been drowning in captchas for the crime of using Firefox. All in the interest of "bot protection", of course.
3/29/2026, 8:57:37 PM
by: simonw
Presumably this is all because OpenAI offers free ChatGPT to logged out users and don't want that being abused as a free API endpoint.
3/29/2026, 8:43:46 PM
by: petcat
> These properties only exist if the ChatGPT React application has fully rendered and hydrated. A headless browser that loads the HTML but doesn't execute the JavaScript bundle won't have them. A bot framework that stubs out browser APIs but doesn't actually run React won't have them.<p>> This is bot detection at the application layer, not the browser layer.<p>I kind of just assumed that all sophisticated bot-detectors and adblock-detectors do this? Is there something revealing about the finding that ChatGPT/CloudFlare's bot detector triggers on "javascript didn't execute"?
3/29/2026, 8:40:48 PM
by: CorneredCoroner
> A headless browser that loads the HTML but doesn't execute the JavaScript bundle won't have them.<p>this is meaningless btw. A browser headless or not does execute javascript.
3/29/2026, 9:57:32 PM
by: Chance-Device
Perhaps the author should have made it clearer why we should care about any of this. OpenAI want you to use their real react app. That’s… ok? I skimmed the article looking for the punchline and there doesn’t seem to be one.
3/29/2026, 8:53:53 PM
by: darepublic
I imagine to stop web automation from getting free API like use of the model
3/29/2026, 9:53:05 PM
by: ripbozo
and chatgpt was then used to write this article. at least try to clean it up a bit
3/29/2026, 8:41:14 PM
by: londons_explore
I just don't understand why bot owners can't just run a complete windows 11 VM running Google Chrome complete with graphics acceleration.<p>You can probably run 50 of those simultaneously if you use memory page deduplication, and with a decent CPU+GPU you ought to be able to render 50 pages a second. That's 1 cent per thousand page loads on AWS. Damn cheap.
3/29/2026, 8:55:51 PM
by: natdempk
Does anyone know how this is integrated on the Cloudflare side and across the app? Is this beyond standard turnstile? Is this custom/enterprise functionality? Something else?
3/29/2026, 9:03:55 PM
by: beering
So are you able to get free inference now that you decrypted this?
3/29/2026, 8:37:40 PM
by: aslihana
I mean, I can easily get them to behaving defensively for not being abused. But MBP with M5 here, my chatgpt tab always get stucked when I hit some prompt.<p>Really really bad user experience, wondering about when they will leave this approach.
3/29/2026, 8:58:38 PM
by: refulgentis
If you have AI write a blog post for ya, when you think it's set, check word count (can c+p to google docs if AI can't pull it off with built in tools), and ask it to identify repetitions if it's over 1000.<p>Also, you can have it spotcheck colors: light orange on light background is unreadable, ask it to find the L*[1] of colors and dark/lighten as necessary if gap < 40 (that's minimum gap for yuge header text on background, 50 for text on background, these have gap of 25)<p>I haven't tried this yet, but, maybe have it count word count-per-header too. It's got 11 headers for 1000 words currently, makes reading feel really stacatto and you gotta evaluate "is this a real transition or vibetransition"<p>[1] L* as in L*a*b*, not L in Oklab
3/29/2026, 9:10:10 PM
by: EGreg
Why does ChatGPT slow down so much when the conversations get long, while Claude does compaction?<p>My best guess is -- ChatGPT is running something in your browser to try to determine the best things to send down to the model API –- when it should have been running quantized models on its own server.
3/29/2026, 8:58:02 PM
by: avazhi
Another AI-slop article.<p>Sick.
3/29/2026, 9:51:24 PM
by: blinkbat
Ok... so... ?
3/29/2026, 9:01:31 PM
by: pencilcode
ai slop analysis finding CF detects non javascript capable browsers with no punchline
3/29/2026, 9:28:03 PM
by: gobdovan
Imagine if they'd put as much effort into making a decent frontend experience.
3/29/2026, 8:54:52 PM
by: heliumtera
I am shocked openai collects data about it's users before users have the opportunity to send the same data to openai servers!
3/29/2026, 8:58:13 PM
by: themafia
My theory is that "AI" doesn't really have any long term paying customers and the majority of the "users" are people who have cooked up some clever hack to effectively siphon computing power from these providers in an effort to crank out the lowest effort ad supported slop imaginable.<p>Every provider seems to have been plauged by these freeloaders to such an extent that they've had to develop extreme and onerous countermeasures just to avoid losing their shirts.<p>What's the word? Schadenfreude?
3/29/2026, 9:12:44 PM
by: 56745742597
[dead]
3/29/2026, 9:10:03 PM
by: tripdout
AI-written article?
3/29/2026, 8:39:00 PM