The spammers thought the same when Bayesian spam filtering started working: "I'll just program a Markov chain to insert some none-spammy words". It did not work out quite so well.
I've also been thinking on how to defeat this, but even the mouse movement seems hard. You are trying to beat the big data statistics that Google has on these mouse movements. Programming a distorted mouse path does not take into account micro-movements (compare with saccades) or speed. To simulate mouse movements convincingly, I figure you'd need a model based on actual mouse movement data on these Captcha's. Also, you may succeed once or twice, but the third time the system is detecting your bot, making all your work void, since your code is now a new signature for bot-detection.
Bots want to quickly leave a message and move on to the next one. Real users first read an article, before they comment. If "Time on site before filling in Captcha" is a feature, then there may be no other way around detection, than for your bot to wait 5-10 minutes before filling in the Captcha.
I think this new system really makes it easier for non-bots to quickly fill in a captcha, and makes it harder for bots. Also because reputation (of IP, of cookies and behavior on Google domains) now seems to play a larger role.
The result of this reputation system for Captcha's is that Google admits to tracking their users outside their own domains. This also places the entire Google+ eco-system, analytics code, Chrome, fonts, charts and Google Hosted Libraries in a different light. Google tracks you everywhere, and the actions you take build or break your online reputation. I am not sure as a legit user that I want to trade this privacy concern, just so I can show my "humanity" and that I am not an evil bot. An evil bot would crawl the pages where these captchas are hosted, and join this data with the captcha user data. Then you can get personalized advertisements when you comment on 4chan in political threads.
