There is a constant war between spammers and website operators, to prevent websites from spam. CAPTCHA's are the tools to protect sites, and are the front line of this arms race.
This is an area of AI research that is directly relevant to the public.
The question is if we should allow postings about how to defeat CAPTCHA's. They are probably in scope, but we don't want to help spammers.
We may get some inspiration from Security.SE. They have some experience in dealing with ethical issues. Over there, they have an explicit close reason for questions about hacking other systems:
Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.
Maybe we need a similar close reason or off-topic flag?