DarKnight: An Agent Framework for Cracking Dark Web CAPTCHAs with Local Small Models

Dark web marketplaces widely deploy a diverse array of CAPTCHA challenges to block automated crawlers. For investigators working in cyber threat intelligence (CTI), this poses a real obstacle — they need to continuously monitor leaked credentials and breach listings, yet must first get past this verification gate. Existing solutions either fine-tune models per site, which doesn't scale, or call commercial vision-language model (VLM) APIs, at the cost of losing operational autonomy.

The Hidden Cost of Commercial APIs

Calling commercial VLM APIs may seem convenient, but it hands over critical control. Policy changes by providers, bans on Tor exit nodes, government regulatory requirements, or even version updates to the model itself can render a solver useless overnight — without investigators being able to intervene. Moreover, pay-per-call pricing means every session and retry incurs a cost, and the expense of long-term monitoring keeps accumulating.

For an investigative system that needs to stay low-profile and run continuously in the dark web environment, this dependency is itself a risk.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a class of technology that distinguishes visitors by generating challenges that are easy for humans to solve but difficult for automated programs to handle. In the dark web marketplace context, common forms include distorted character recognition, slider puzzles, clicking specific target images, and Cloudflare-style Turnstile. For crawlers, CAPTCHAs are not just an identification barrier, but also part of rate limiting and access control; a failed solve often means the session is reset, which increases request overhead and raises the risk of being flagged.

DarKnight's Core Approach: A Retrieval-Guided Agent

DarKnight is a self-improving agent framework designed to run a locally hosted, open-weight VLM on a single workstation GPU within the investigator's own Tor crawler environment — no third-party services, and no per-market training required.

According to the original description, its workflow includes several key components:

Dual-Signal RAG Retrieval

When faced with a new CAPTCHA image, DarKnight first retrieves records of past successful and failed attempts on similar images. Successful experiences tell it what strategies work, while failure records help it avoid known pitfalls. This retrieval mechanism, which leverages both positive and negative signals simultaneously, is the foundation of the framework's self-improvement capability.

Image-Specific Preprocessing Pipelines

The framework dynamically assembles a targeted preprocessing plan based on the characteristics of the current image, rather than applying the same pipeline to every image. This is validated by the data later in the article — selectively using tools preserves more useful information than uniform preprocessing.

Site-Feedback-Based Learning

After each attempt, the pass or fail verdict returned by the site is absorbed by the framework and used to adjust subsequent decisions.

Retrieval-augmented generation (RAG) is a method that combines external knowledge retrieval with a generative model: before producing an answer, the model retrieves entries relevant to the current input from a knowledge base as context. DarKnight uses a dual-signal variant — the retrieval targets include both historical successes and failures, so the model obtains constraints on "what to do" and "what not to do" simultaneously during inference. Compared with relying solely on prior knowledge in model parameters, RAG lets the system continuously accumulate site-specific experience as it runs, which is a key source of its self-improvement capability.

Empirical Results: Tool Selection Beats Parameter Scale

The research team conducted case studies on four real dark web marketplaces, with the core conclusion: an agent's tool selection capability is more effective than simply scaling up model parameters.

On one of the most heavily defended marketplaces, a deployable open-weight VLM paired with DarKnight achieved an 83.2% pass rate — 37.2 percentage points higher than its base model. This result even surpassed the frontier commercial model Claude Opus 5's 44% on the same task.

Another notable figure: DarKnight recovered 48.2% of baseline failure cases at a cost of only 7.6% performance degradation. This shows that selectively using preprocessing tools can avoid most of the negative effects of uniform preprocessing.

Open-weight VLMs refer to vision-language models whose parameters can be publicly downloaded and run locally, such as the Qwen2.5-VL, InternVL, and similar series. Unlike commercial APIs, open-weight models do not rely on network calls; inference runs entirely on local GPUs, and they are therefore unaffected by provider policies, rate limits, or censorship. However, such models typically have smaller parameter counts, and their zero-shot capabilities on complex tasks may be weaker than frontier closed-source models; DarKnight's contribution is precisely to use retrieval and tool orchestration to let smaller open-source models match or even surpass large models on specific vertical tasks.

Implications for Threat Intelligence Work

DarKnight's value is not only in its technical metrics. It addresses a practical need: investigators need to continuously and controllably collect dark web intelligence without giving up operational autonomy. The setup of local execution, open weights, and a single GPU keeps the entire system under the investigator's own control, immune to disruption by external decisions.

From a methodological perspective, this work also suggests a broader idea — on specific vertical tasks, a retrieval-guided agent framework paired with a small model may be more practical and sustainable than directly calling a large-model API.

One-line Summary

DarKnight uses a local open-weight VLM plus a retrieval-guided agent framework to surpass Claude Opus 5 on dark web CAPTCHA solving with an 83.2% pass rate.

Paragraph Summary

DarKnight is a self-improving agent framework for dark web threat intelligence collection, designed to replace commercial VLM APIs by letting investigators run a locally hosted open-weight model on a single GPU within their own Tor crawler environment. Its core mechanisms include dual-signal RAG retrieval — using both historical successes and failures to guide decisions — as well as image-specific preprocessing pipelines dynamically assembled from image characteristics, with strategies continuously adjusted via site feedback. In tests on four real dark web marketplaces, a deployable open-source VLM paired with DarKnight reached an 83.2% pass rate on the most heavily defended market, 37.2 percentage points above the base model and exceeding Claude Opus 5's 44%. The research also shows that selective tool use can recover 48.2% of baseline failure cases at only a 7.6% degradation cost, indicating that tool selection capability is more critical than parameter scale.