that's actually how you do it. adversarial systems like those are prime candidates. one agent develops detection mechanisms and the other agent defeats them. progression signal is easy to get.

and you bootstrap with existing javascript detection engines.

the challenge is usually the human input data, your objective is to be clustered among the humans and for that you need to know what humans look like.

this is not an open ended arms race, it will end once the bots approximate humans to a sufficient degree - false positive rate for detection will become unacceptable even if the detection system is slightly ahead.