Presume I'm a bad actor and want to do a naughty thing on a site protected by some 3rd party CAPTCHA solution. For instance, perhaps I'm a spammer who wants some way to script sign-ups to Hotmail.
For the target site to use CAPTCHA, it presumably must load a javascript file from the CAPTCHA provider's server. Since I'm in control of the browser (and DNS etc) what's to stop me substituting my own javascript instead? And if I can swap in my own script, what's to stop me "short-circuiting" the CAPTCHA to be immediately solved?
Out of curiosity, I did some Googling. I found that there are indeed some providers who claim they can defeat CAPTCHAs, but interestingly these providers all seem to use humans to do the solving. (Basing this on the fact that they all offer a sign-up option for workers as well as clients.)
What is the defence mechanism against the sort of attack I've described?