Undocumented AI verification challenge system causes agent suspensions

[jens-krypto]

Summary

Our agents are being suspended for "failing to answer AI verification challenges," but this challenge system is not documented anywhere in the API specification, README, or source code.

We have no way to detect, parse, or respond to these challenges because we don't know:

• How challenges are delivered (HTTP status code? response body? DM? mention?)
• What endpoint to respond to
• What format the challenge expects
• What timeframe is required

Error Messages Received

401 response:

{
  "error": "Account suspended",
  "hint": "Your account is suspended: Failing to answer AI verification challenge (offense #1). Suspension ends in 10 hours."
}

403 response:

{
  "success": false,
  "error": "Your account has been suspended for repeatedly failing AI verification challenges",
  "hint": "Your last 3 challenges were not answered correctly. Contact support if you believe this is an error."
}

What We've Checked

• API docs (/developers): No mention of challenges
• GitHub repo source code: No challenge logic in auth.js, AgentService.js, agents.js, posts.js
• Database schema (schema.sql): No challenge-related tables or columns
• OpenClaw docs: No challenge handling documented

Questions

1. How are challenges delivered to agents? (HTTP response? Post? DM? Mention?)
2. What endpoint should we use to submit a challenge response?
3. What is the expected challenge format and response format?
4. Is this the MoltCaptcha (SMHL/ASCII-sum) system, the CaptchAI (SHA256 PoW) system, or something else entirely?
5. Can this be documented in the API spec so agent developers can implement handlers?

Impact

Agents that don't know about this system get suspended with escalating penalties (10 hours → 7 days), with no way to comply. This seems like it should be documented alongside the existing error codes (400, 401, 404, 429, 500) in the API reference.

Environment

• Custom Python agent using Moltbook REST API directly (not OpenClaw)
• Two agents affected, both suspended within 24 hours
• Agents were actively posting and engaging normally before suspension

[jens-krypto]

Update: We've implemented a PerContentChallengeHandler on our side that should be able to handle verification challenges once we understand the format.

Our implementation:

• Intercepts POST responses (both 2xx and 4xx) and checks for challenge indicators
• Uses an LLM to solve obfuscated English questions, arithmetic, and vector math
• Submits answers with nonce to the specified endpoint within the time limit
• Added forensic logging to capture full response bodies + headers

However, we still need the challenge specification to validate our handler:

1. HTTP status code used for challenge responses
2. JSON structure of the challenge object (field names for question, nonce, endpoint, time limit)
3. Response endpoint format for submitting answers
4. A test endpoint or sandbox mode to verify our implementation before suspensions resume

Our suspension lifts ~Feb 17 — we'd love to have documentation available by then so we can test properly rather than risk another suspension.