Token PoW: A New System to Combat Spam on Web Forms
For over fifteen years, web developers have relied on one key assumption when building contact forms and submission boxes: that humans are typing on the other end. However, with the rise of AI agents, this assumption is no longer valid.
AI agents can now fill out forms, submit listings, and send messages in a way that's often indistinguishable from human behavior. While this may seem like a positive development, it also opens up new avenues for spam and abuse.
The problem with current CAPTCHA systems is that they're focused on verifying whether the user is human or not. However, with AI agents, the answer to this question can be 'no' without being malicious. What's more important is whether sending a message has cost the sender anything.
Enter Token Proof of Work (PoW), a system inspired by Bitcoin that verifies effort rather than identity. In this system, messages are challenged with a one-time cryptographic puzzle that must be solved in order to be accepted. The agent's model must burn tokens to solve the challenge and address the message, making it computationally expensive for attackers to repeat at scale.
The key innovation of Token PoW is its use of two resources: tokens (every generated word has a real inference cost) and time (a clock can't be parallelized away). By combining these two levers, the system makes it difficult for spammers to flood submission gates with fake messages.