I was noticing in my Recent log entries a large number of "access denied" entries. In order to see what a user might see, I logged out and pasted one of the access denied URL's into my browser. What I got was the normal access denied page except that Captcha was not present on the page. On all navigation generated pages I have the Captcha text challenge, but not on these forced error pages, just the user login block. The thing is, you get logged in without a challenge.
Here is the format, you can supply any numbers you want:
PASSED: [[SimpleTest]]: [MySQL] 733 pass(es). View
FAILED: [[SimpleTest]]: [MySQL] Unable to apply patch 893810-captcha-on-access-denied-admin-pages_02.patch. This may be a -p0 (old style) patch, which is no longer supported by the testbots. View
FAILED: [[SimpleTest]]: [MySQL] Unable to apply patch 893810-captcha-on-access-denied-admin-pages_01.patch. This may be a -p0 (old style) patch, which is no longer supported by the testbots. View