Share

Two Kinds of Influence

Nobody Tampered With the Agent's Instructions

By Sevda Polat— September 3, 2026

Feature image for article: Nobody Tampered With the Agent's Instructions

Agent security conversations center on prompt injection: someone hides instructions in the input, the agent gets hijacked. Researchers at CHI 2026 found something running on different machinery. They sent shopping agents through ordinary commercial checkout flows and watched them notice anomalies, duplicate items, pre-checked consent boxes, and proceed anyway. No instructions were tampered with. The commercial web shaped the outcome through its normal operation. Current law has no answer for that case: when an agent completes an authorized action it was environmentally induced to take, who bears the commitment?

Two Kinds of Influence

Nobody Tampered With the Agent's Instructions

By Sevda Polat— September 3, 2026

Agent security conversations center on prompt injection: someone hides instructions in the input, the agent gets hijacked. Researchers at CHI 2026 found something running on different machinery. They sent shopping agents through ordinary commercial checkout flows and watched them notice anomalies, duplicate items, pre-checked consent boxes, and proceed anyway. No instructions were tampered with. The commercial web shaped the outcome through its normal operation. Current law has no answer for that case: when an agent completes an authorized action it was environmentally induced to take, who bears the commitment?

Agent Susceptibility in Practice

Your Best Agent Is Your Most Gullible One

By Sable Whitford— September 3, 2026

Feature image for article: Your Best Agent Is Your Most Gullible One

TrickyArena tested six web agents against deceptive interface patterns — fake urgency, pre-checked boxes, double-negative opt-outs — and found a 41% overall susceptibility rate. The distribution underneath that average matters more: the agents best at finishing tasks were also the ones most likely to get manipulated, and the agents that looked resistant mostly just stalled before reaching the trap. Evaluate on task completion alone and you may be selecting for gullibility.

Agent Susceptibility in Practice

Your Best Agent Is Your Most Gullible One

By Sable Whitford— September 3, 2026

TrickyArena tested six web agents against deceptive interface patterns — fake urgency, pre-checked boxes, double-negative opt-outs — and found a 41% overall susceptibility rate. The distribution underneath that average matters more: the agents best at finishing tasks were also the ones most likely to get manipulated, and the agents that looked resistant mostly just stalled before reaching the trap. Evaluate on task completion alone and you may be selecting for gullibility.

Choice Architecture Reading

Why Smarter Agents Are Easier to Manipulate: The DECEPTICON Inverse-Scaling Finding

Stanford researchers found that larger language models fall for dark patterns more often, not less. Worth sitting with.

SusBench Puts Numbers on Which Dark Patterns Fool Agents and Which Don't

A benchmark across 313 tasks maps where agents and humans share the same manipulation vulnerabilities, and where they diverge.

TrickyArena: Measuring How LLM Web Agents Fall for Dark Patterns

Human Oversight Doesn't Fix Agent Susceptibility to Dark Patterns

The AI AGENT Act: Consumer Protection Meets Agentic Delegation

Agentic Commerce Is Coming, but Human-Era Regulation May Not Translate

Choice Architecture Reading

Why Smarter Agents Are Easier to Manipulate: The DECEPTICON Inverse-Scaling FindingStanford researchers found that larger language models fall for dark patterns more often, not less. Worth sitting with.

SusBench Puts Numbers on Which Dark Patterns Fool Agents and Which Don'tA benchmark across 313 tasks maps where agents and humans share the same manipulation vulnerabilities, and where they diverge.

Quick links

TrickyArena: Measuring How LLM Web Agents Fall for Dark Patterns

Human Oversight Doesn't Fix Agent Susceptibility to Dark Patterns

The AI AGENT Act: Consumer Protection Meets Agentic Delegation

Agentic Commerce Is Coming, but Human-Era Regulation May Not Translate

Influence Vectors Compared

When a web agent acts against its user's interests, two very different things might be happening. Someone may have injected hidden instructions into the agent's input — a security attack in the familiar sense. Or the agent encountered a website designed to steer decisions through interface design: countdown timers, pre-checked boxes, buried fees.

Both produce outcomes the user didn't want, and they tend to get grouped under "agent security." But the mechanisms differ, the people behind them want different things, the applicable legal frameworks barely overlap, and the defenses that work for one can actually make the other worse.

Influence Vectors Compared

When a web agent acts against its user's interests, two very different things might be happening. Someone may have injected hidden instructions into the agent's input — a security attack in the familiar sense. Or the agent encountered a website designed to steer decisions through interface design: countdown timers, pre-checked boxes, buried fees.

Both produce outcomes the user didn't want, and they tend to get grouped under "agent security." But the mechanisms differ, the people behind them want different things, the applicable legal frameworks barely overlap, and the defenses that work for one can actually make the other worse.

Core Mechanism

One Smuggles Instructions, the Other Reshapes the Environment

Prompt injection hides adversarial instructions in an agent's input through invisible text, encoded payloads, or disguised markup. Choice architecture works through the legitimate interface: defaults, urgency cues, pre-checked options, friction. No rogue instruction enters the processing pipeline. The manipulation is the environment itself.

Actor Intent

Attackers Want System Access, Operators Want More Revenue

Injection attackers aim to commandeer the agent: exfiltrate data, trigger unauthorized transactions, break things. Dark pattern operators pursue commercial gain through interface choices that favor the site owner. One group treats the agent as a system to compromise, the other as a customer to influence.

Inverse Scaling

Smarter Agents Resist Injection but Fall for Manipulation

Stanford's DECEPTICON study found dark pattern susceptibility rose from 43.8% to 73.7% as model size increased. Larger models reason more carefully about manipulative cues instead of dismissing them. The capabilities that help against injection — better reasoning, deeper context processing — make choice architecture problems worse.

Threat Visibility

Injections Hide While Dark Patterns Sit in View

Injections rely on invisibility: zero-font text, off-screen elements, encoded payloads. Dark patterns are fully rendered. The countdown timer and the pre-checked add-on are right there on screen. What's concealed is the intent to steer behavior, not the interface element doing the steering.