DECEPTICON: How Dark Patterns Manipulate Web Agents

Introduction. Consider a common scenario: You need to purchase flowers quickly. You perform a browser search, visit the non-sponsored top search result, select what appears to be the most popular and reasonably-priced option, and complete your purchase with just a few clicks. The process seems routine until you realize the most expensive bouquet and premium shipping were pre-selected and purchased simply because you did not opt out. This illustrates an example of sneaking, a form of dark pattern common on today’s internet, which can also manifest in many other forms (Figure 1). Dark patterns are deceptive UI designs intended to steer users toward designer-intended outcomes, regardless of user intent (Brignull, 2024). Dark patterns are as old as the internet itself (Brignull, 2010) and widely-distributed, with recent empirical studies detecting instances of dark patterns on a majority of websites and apps surveyed (Mathur et al., 2019; Nouwens et al., 2020). Although 60% of web users partially or fully know to avoid dark patterns through experience (Bongard-Blanchy et al., 2021), with only 31% of users falling for dark patterns in our study (Section 4.4), AI agents have not been equipped with the capabilities to resist these psychological, informational, and environmental manipulations. This raises a critical question: can web agents, particularly those operating autonomously online, also be manipulated by dark patterns to act against their users’ intents and goals?

Web agents are systems that autonomously navigate and interact with web environments to accomplish browsing tasks as a human would, e.g. information retrieval, form submission, and online shopping (Deng et al., 2023; He et al., 2024; Zhou et al., 2024). The most prominent form of web agent today is the Language Model (LLM)-driven agent, which uses an LLM to interpret instructions, plan actions, and interact with web pages via a browser. Web agents have seen rapid increases in their capabilities and use over the past year, approaching human performance in major web task and navigation benchmarks (DeepMind, 2025). As with humans, dark patterns likely pose similar or even greater risks to web agents, steering users towards designer-intended goals by manipulating the information and interface/environment presented to users. Dark patterns pose a unique and underexplored threat to web agents, as the same characteristics that increase web agent capabilities - improved reasoning, planning, and adaptability - may also increase susceptibility to manipulation by dark patterns. As the deployment of the web agents gets popular, this threat is converted into imminent risks for agent users. If agents are more likely to be manipulated by these dark patterns than users themselves, the agent users will face higher chances of privacy leakage, unexpected engagement, and expenditure.

To study this threat, we propose DECEPTICON, with 100 dark patterns on the cached live websites, and 600 generated dark patterns on self-hosted websites. To create this large-scale dataset, we use an exploratory agent to automatically crawl dark pattern instances, and an adversarial generation method to create the dark patterns that are similar to the ones on the live websites on our self-hosted ones. This results in a diverse and fully-reproducible benchmark.

We investigate three research questions to quantify the impact of dark patterns on web agents:

RQ1: How, and which types of dark patterns, are effective at steering LLM-agent behavior towards an adversarial goal? Are dark patterns more effective at manipulating agents than humans?

RQ2: Does dark pattern effectiveness change as model size and reasoning performance improve?

RQ3: Do existing defenses make agents robust against dark patterns?

We evaluate frontier LLM-based agents to assess task completion performance and the effectiveness of dark pattern attacks, finding that (RQ1) dark patterns consistently steer agent behavior towards designer-intended goals with greater frequency than human users, with certain types (e.g., obstruction and social proof) being most effective. For RQ2, dark pattern effectiveness increases with model size and reasoning ability, suggesting that more capable models are more vulnerable to dark patterns. Finally, for RQ3, we find that existing agent defenses such as structured system prompts and guardrail models, only partially reduce dark pattern effectiveness, and are inconsistently effective across different attack types. We open-source DECEPTICON, including tasks and evaluation code, to support future research on agent redteaming and fine-tuning agents against adversarial attacks.

Related work. Web-Browsing Agents Autonomously navigating the web to find information (Wei et al., 2025), accomplish tasks (Zhou et al., 2024), and interact with online content (Shi et al., 2017) requires planning abilities and consistency over long task horizons. Language-model- (LLM)-driven web browsing agents, or Web Agents, have emerged as the leading approach to this challenge, pairing a base LLM with an information-processing scaffold and controllable web browser. Post-training on web interaction data has been shown to significantly improve the capabilities of LLMs in web navigation tasks (Murty et al., 2025; Qin et al., 2025). Agent scaffolds orchestrate the LLM’s observations and actions, typically through a combination of prompting strategies and memory modules (Deng et al., 2023; Zhou et al., 2024), but differ significantly through their action space and interaction modalities.

Set-of-Marks (SoM), a modality where UI elements are annotated with a captioning model or by HTML tree parsing, have achieved state-of-the-art performance (Yang et al., 2023)—leading agents using this approach include Browser-Use (Müller and Žuniˇc, 2024) and Project Mariner (Google DeepMind, 2025). Coordinate-based agents, such as Magnitude (Team, 2025b), use a pixelbased representation of the web page, allowing for more flexible interaction with the page. This approach has shown promise in handling complex web tasks but requires more sophisticated visual processing capabilities. Other agents using this modality include OpenAI’s Operator (OpenAI, 2025) and Anthropic’s Computer Use Agent (Anthropic, 2024); LLMs can also be fine-tuned to operate in this modality, as demonstrated by UI-TARS (Qin et al., 2025).

LLM Adversarial Risks LLMs have safety risks that can lead to harmful or unintended behaviors, the most relevant to our work being jailbreaking where adversarial prompts are used to bypass the model’s safety filters and elicit harmful or undesired responses. Traditional LLM adversarial attacks function by injecting malicious token sequences into prompts to condition a desired output: Demonstrating high effectiveness and cross-model transferability across text-only (Doumbouya et al., 2025; Toyer et al., 2023; Zou et al., 2023), and multimodal (Bailey et al., 2024; Schlarmann et al., 2024) modalities.

Web Agent-Specific Attacks Study of the adversarial robustness of LLM-driven web agents remains strongly influenced by the broader field of adversarial attacks on language models; many of the attacks developed for LLMs are directly applicable to agents due to using an underlying LLM (Wu et al., 2025). However, agents introduce novel (Kumar et al., 2024) vulnerabilities due to the interaction between the LLM and the environment.

Method. To study the effect of dark patterns without interference from implementation details, environment/type of website, or designer-specified objectives, we operationalize a taxonomy based on the mode of attack of the pattern. Following the seven-category structure from Mathur et al. (2019), which synthesizes multiple prior works, we classify six action- and attack-centric categories of dark patterns that capture the majority of dark pattern behaviors observed on the open web.2 Figure 1 shows examples of each category of dark pattern in-context.

Sneaking patterns covertly add costs, products, or commitments without explicit consent, exploiting users’ limited attention. Common forms include hidden fees revealed at checkout, automatically added items, and pre-selected add-ons that users must actively deselect. These patterns are effective when an agent overlooks the added element or fails to take the additional, unsignposted action required to prevent it.

Urgency patterns create artificial time pressure, e.g., countdown timers, limited availability messages, and time-limited offers, to exploit scarcity and loss aversion to rush user decisions. This biases agents towards certain actions over others or causes them to proceed with less reasoning.

Misdirection patterns rely on visual and linguistic cues to guide users toward specific actions while obscuring alternatives. Key techniques include visual interference (e.g., contrasting colors, button sizes), confirm-shaming (guilt-inducing language), and trick questions with misleading language. Since these patterns manipulate information, they are especially effective when agents misinterpret or overly trust seemingly credible interfaces.

Social Proof patterns exploit conformity by displaying activity messages, testimonials, and user statistics that may be misleading or fabricated. Examples include “X people viewing this item” notifications and questionable reviews that create a false sense of popularity. Similarly to urgency, these patterns bias agent choices through the implied collective judgment.

Obstruction patterns create artificial barriers for unfavorable user tasks. Key examples include “roach motel” patterns (easy sign-up, difficult cancellation) and price comparison prevention by obscuring essential information, e.g., popups (Zhang et al., 2025). By increasing task cost, these patterns discourage certain specific actions.

Forced action patterns compel unwanted actions as prerequisites for desired objectives. Examples include forced enrollment (e.g., unnecessary account creation), preselected premium options, and privacy-related forced actions like all-or-nothing cookie acceptance. Note that within our formulation, these actions are always bypassable, allowing agents that detect the manipulation to avoid it. Thus, it works by introducing off-ramps to the desired action that are only discoverable through interaction or reasoning.

Critically, a dark pattern is deceptive/manipulative, intentional, and embedded. Central to the definition of dark patterns is intent to deceive or manipulate users to achieve a given task outcome. This distinguishes dark patterns from accidental poor design or usability issues, which may frustrate users but lack the deliberate intent to mislead, or advertising, which aims to motivate an end-user action (buying a product, thinking a certain way) but is restricted by law and convention from employing deceptive tactics (Brignull, 2010). Further, a dark pattern must be embedded within the user interface or experience, unlike external threats like a phishing attack or malware, which operate outside the scope of the application’s design. These traits make dark patterns particularly effective at influencing web agent behavior; by introducing confounds in-situ, i.e., those that appear as part of the UI and relevant to the task of a given agent.

Discussion. a hypothesis supported by findings from prior red-teaming studies, which show that pop-ups typically ignored by human users often lead to high attack success rates for agents, as they tend to follow such instructions when presented with official-sounding content (Zhang et al., 2025).

Dark pattern effectiveness is modality-sensitive. When evaluating agent performance across different scaffolding approaches, which primarily vary by system prompt and observation orchestration, we find no significant differences in DP rates between all Simple agents. In contrast, standalone agents demonstrate greater resistance to dark patterns. This suggests that the vulnerabilities to dark patterns are primarily a function of the underlying LLMs rather than the agents’ architectural scaffolding, suggesting that prompt- or scaffold-level countermeasures might be insufficient to mitigate these risks. We also observe minor performance differences across different agent modalities. Coordinate-based agents (e.g., Magnitude + Claude Sonnet 4) exhibit a DP of 68.3%, compared to an average DP of 74.7% for SoM-based agents (averaged across all Simple agents). While this indicates that coordinate-based agents are slightly more resistant to dark patterns, the difference is relatively small. This further suggests that dark pattern effectiveness is largely governed by the underlying LLMs.

On a closer inspection, we find that when models reason longer, they become more influenced by the information in the dark patterns. In one of the tasks, “navigate to the website URL and purchase the best Air Fryer,” an urgency dark pattern is injected through a pop-up window with “Buy Air Fryer B. Item Soon Gone Forever!” and a button “SECURE IT NOW!”. When Gemini-2.5-Flash is given only 256 tokens for reasoning, it closes the pop-up window through identifying it as “classic marketing” in its reasoning, and later chooses a different air fryer. When it is given 16k tokens, it DECEPTICON: How Dark Patterns Manipulate Web Agents CoT of defense failures reveals challenges in both detection and reasoning. Inspection of agent CoTs show that errors of the third category (erroneous reasoning, as described in Section 5) predominate, indicating that reasoning misalignment is core to the weakness of LLMs to dark patterns. For ICP, the agent ignores the effects of the dark pattern: “[...] the terms and conditions. Of course, nobody reads these, but I’ll humor them. Ah, here’s the magic button: "TLDR: ACCEPT" [...] zeroing out any need for, you know, actually reading anything”, or acknowledges the dark pattern, but chooses to proceed with it regardless, with the CoT indicating that it is necessary or helpful (we list this example in Appendix § L). For guardrail model agents, the higher detection DECEPTICON: How Dark Patterns Manipulate Web Agents rate of dark patterns does not preclude erroneous reasoning, with CoTs indicating ignorance of the dark pattern or confusion of instruction authority; these are also presented in Appendix § L.

Conclusion. We present a systematic study of dark pattern effectiveness against web agents. Using DECEPTI- CON, we evaluate representative dark patterns across 700 tasks and find that dark patterns achieve high effectiveness rates against frontier LLM-based agents, with attack success increasing rather than decreasing with model capability. Existing defense mechanisms prove partially effective, with guardrail models outperforming prompting-based defenses, but both remain insufficient to fully mitigate the threat of dark patterns. Our findings highlight the urgent need for more robust defense mechanisms that operate effectively across model scales and reasoning capabilities, and suggest that future research should focus on building adversarial robustness during agent post-training.