Ant Group published an agent trained to beat CAPTCHAs — but not the weights, and not a licence

InclusionAI, the open-source arm of Ant Group, put up a model card on 26 August 2026 for UI-Venus-2-9B, a GUI agent meant to drive phones, browsers and desktop operating systems on a user's behalf. Two things about that page are worth a reader's attention, and neither is a benchmark number. The first is that the release described has not happened. The card states plainly that "this repository releases the full-parameter weights of UI-Venus-2-9B". The repository contains a README, a configuration file, a tokenizer and four illustrations. It contains no weight files. Downloads stood at zero two days after publication. The second is the licence, and here the maker is unusually candid. Under "Release Status" the card says the model-weight licence "is pending final confirmation and will be added before public release", and explains why the obvious answer was not used: "The Apache-2.0 declaration has intentionally not been carried over because the current upstream materials contain conflicting license statements." The upstream in question is Qwen3.5-9B, Alibaba's model, on which UI-Venus-2 is built. In other words, one Chinese laboratory is publicly declining to state a licence because it cannot work out what licence it received from another. That matches what this catalogue found in the same month at the source: several Alibaba releases described in the press as open turn out, in the licence file rather than the metadata label, to require a separately negotiated agreement from anyone serving the model commercially at scale. What the model is trained to do is itself notable. InclusionAI lists five task families in training — grounding, mobile, web, computer, and CAPTCHA — and reports results on five CAPTCHA benchmarks, including 78.1 per cent on its own VenusBench-CAPTCHA, which requires the full multi-action sequence, sliders and rotations included, in a single turn. Solving CAPTCHAs is not a side effect here; it is a trained objective with its own reinforcement-learning stage. The safety table is published alongside it and does not flatter the result. On OSHarm, which covers deliberate misuse and prompt injection, the attack success rate is 11.3 per cent, down from 25.3 for the base model. On OSBlind, which tests instructions that look harmless but whose execution causes harm, the rate is 48.8 per cent — better than the base model's 79.4, but still close to one in two. InclusionAI writes the caveat itself: the results "do not make harmful-action risk negligible", deployments should keep a human in the loop, and "CAPTCHA capabilities should only be used in authorized environments". On task performance the reported figures are strong for the size: 80.2 per cent on AndroidWorld, 70.8 on OSWorld-Verified, 90.8 on WebVoyager. All of them come from the maker, and the technical report they cite is not public yet either. This catalogue will open a profile for UI-Venus-2-9B when the weights and the licence actually appear.