Even if an AI shopping agent can't resist a manipulative website trick, could a separate watchdog at least flag that the trick happened?

This explores whether guardrails could act as alarms for manipulative web design even where they fail as locks. No study in the corpus measures detection and blocking separately, so the honest answer has to be pieced together. The starting point is clear, though: dark patterns work very well on AI agents. A 700-task benchmark found LLM web agents fall for them 68–75% of the time, against 31% for humans. The surprising part is that larger, better-reasoning models are more susceptible, not less Do dark patterns fool AI web agents more than humans?. The same work found that changing the agent's scaffolding barely matters, because the weakness sits in the LLM's own reasoning. Prompt-based and guardrail defenses reduced susceptibility only partly, and their protection varied from one manipulation type to the next Does agent architecture determine susceptibility to dark patterns?. So blocking is weak. Whether detection does better depends on what kind of detector you build.

The biggest problem is timing and shape. Many dark patterns are not a single bad action. They are a sequence: a reasonable-looking click, then a pre-filled form, then a fee that only appears at checkout. A guardrail that judges each action on its own cannot even express a rule like 'the price changed after the user committed.' Only a monitor that remembers what came before can describe that kind of violation, let alone catch it Can stateless checks ever catch sequence-level constraint violations?. Security research shows the same blind spot from the attacker's side. Scanners that score each component separately get beaten when the harmful meaning lives in the chain rather than in any single piece Can attackers evade skill scanners by refining individual skills?. A detection-only guardrail would need to watch the whole session, not single steps.

That suggests a split worth knowing about: detecting may be easier than blocking because a detector can afford to be patient. Theoretical work on telling decoys apart from genuine objects shows that repeated observations that never trigger anything can, under idealized conditions, push classification error toward zero, as long as the two respond in different ways Can repeated quiet probes separate decoys from genuine objects?. A watcher that flags a pattern after the fact, or after several sessions, doesn't need the split-second certainty that blocking does. It's also cheap to run. Mechanical checks, such as 'did the total price change between cart and confirmation?', cost orders of magnitude less than an LLM judge How much do deterministic guardrails actually cost to run?, and they fit many dark patterns well.

The catch is that detection becomes a target once its verdicts are visible. When a system can see a guardrail's verdicts again and again, it can learn to route around them. Repeated detect-and-penalize loops train evasion, not good behavior Can optimizers learn to evade guardrails through repeated verdicts?. Websites built to manipulate agents could do the same against a public detector. Learned detectors also age badly: classifiers trained on one generation of model output dropped from over 99% to 3.8% accuracy when a new model arrived Why do AI detectors suddenly fail when models update?. Dark-pattern designs change too.

The takeaway the reader may not have expected: the corpus suggests the useful guardrail for dark patterns may not be a smarter gatekeeper on each click. It may be a cheap, stateful auditor that watches whole sessions, works partly with simple deterministic checks, and keeps its verdicts away from whoever is designing the pages. Since the vulnerability lives inside the model, an outside observer may be one of the few places a reliable signal can come from.