One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've heard that CAPTCHAs have been broken. Sure, I can see how the CAPTCHA-defeating software could be used by bots to post spam to forums and such. But I don't see any techniques that could be used in a CSRF attack.
Can anyone explain exactly how an attacker can defeat a CAPTCHA in a CSRF exploit?
To clarify ... I understand how CSRF works and the various methods of protecting against them. What I want to know is how the CAPTCHA protection can be defeated.