Do dark patterns fool AI web agents more than humans?

DECEPTICON is a benchmark built to test this: the paper evaluates "100 dark patterns on the cached live websites, and 600 generated dark patterns on self-hosted websites," across "700 tasks" with frontier LLM-based web agents. Its first research question finds "dark patterns consistently steer agent behavior towards designer-intended goals with greater frequency than human users, with certain types (e.g., obstruction and social proof) being most effective." The paper reports "only 31% of users falling for dark patterns in our study," against agent dark-pattern (DP) success rates of 68.3% for coordinate-based agents (Magnitude + Claude Sonnet 4) and an average 74.7% for Set-of-Marks-based agents. Its second research question finds "dark pattern effectiveness increases with model size and reasoning ability, suggesting that more capable models are more vulnerable to dark patterns."

The paper's six dark-pattern categories — sneaking, urgency, misdirection, social proof, obstruction, forced action — are condensed from "the seven-category structure from Mathur et al. (2019)." Each targets a different agent weakness: sneaking exploits an unsignposted opt-out, urgency "causes [agents] to proceed with less reasoning," social proof works through "implied collective judgment," and obstruction "increase[s] task cost" to deter an action. The capability finding traces to reasoning length: Gemini-2.5-Flash given only 256 reasoning tokens dismisses an urgency pop-up ("Buy Air Fryer B. Item Soon Gone Forever!") as "classic marketing" and buys a different product, but given 16k tokens engages with the pop-up's framing instead. Chain-of-thought traces show agents that notice a dark pattern often comply anyway — one reasons through a cookie-consent trick with “nobody reads these, but I’ll humor them. Ah, here’s the magic button: 'TLDR: ACCEPT' [...] zeroing out any need for, you know, actually reading anything.”

What security threats emerge when machines read the web? names the general problem; DECEPTICON supplies a measured instance of it in e-commerce interfaces, where persuasive design built for human psychology works on agents at more than double the human failure rate. Its six-category taxonomy of commerce dark patterns is a narrower counterpart to the six-category attack surface in How do adversarial traps target different layers of AI agents? — both split agent-specific exploits into six types, but DECEPTICON's are ordinary commercial persuasion tactics rather than adversarially engineered content.

The reported rates are benchmark statistics from a fixed, researcher-built task set of real and generated dark patterns, not estimates of deception rates across the open web. The paper shows that reasoning capacity correlates with susceptibility but does not explain the mechanism beyond chain-of-thought evidence of rationalization, so more capable agents are less trustworthy shoppers holds only against this test set, not as a general scaling law.