In a benchmark task built to test how web agents behave under pressure, a model shopping for an air fryer hit a pop-up announcing that the product was nearly sold out, with a button urging immediate purchase. Given a small reasoning budget, the model read the message as marketing, closed it, and kept shopping. Given a larger budget, it closed the same pop-up and then circled back, treating the urgency language as evidence that the advertised product might be worth buying. The version that thought longer bought the thing.
DECEPTION, a study accepted at the ICLR 2026 machine learning conference, compared how dark patterns — deceptive interface design, such as preselected premium options, fake scarcity timers, and consent questions worded so that agreeing looks like declining — move web agents and humans through the same tasks. The headline finding: dark patterns pushed agents into unintended outcomes more than 70% of the time, against 31% for the human participants. That number travels well. But the result that matters for anyone operating these systems came when the researchers varied capability.
Across four sizes of the Qwen2.5-VL family, dark patterns worked on 43.8% of attempts at 3 billion parameters and 73.7% at 72 billion. With Gemini-2.5-Flash, raising the reasoning-token budget from 256 to 16,384 moved the manipulation rate from 38.5% to 71.2%. OpenAI's o3 stayed roughly flat across reasoning levels, so this is a tendency rather than a law — and worth watching: if newer frontier models show susceptibility falling as reasoning rises, the reading here needs revising. Where the relationship appeared at all, though, it was steep.
The trace analysis is where the finding gets specific. Some agents miss side effects, like a donation quietly added to a cart. Some take interface claims at face value, reading an unchanged price as a discount because the page labels it one. The third failure mode is the most revealing: agents that identify the deceptive wording correctly and then reason their way into the wrong choice anyway. In one task, an agent flagged a double-negative privacy question as manipulative, then selected the option permitting third-party data sharing.
The agent read the page accurately. It carried that accurate reading into a longer chain of reasoning, and the chain ended somewhere worse than a smaller model reached by never engaging closely enough to be moved. The extra reasoning gave the manipulation more surface to act on.
Two defenses were tested at the model layer. A system prompt warning about dark patterns reduced manipulation by about 12 percentage points on average, and unevenly: in some runs the agent acknowledged the warning and still took the shortest route to finishing the task. A separate guardrail model cut susceptibility by roughly 29 points, though that figure assumes the guardrail catches the pattern every time. Measured detection accuracy ran from 32% to 71%.
I've argued before that the web communicates through visual convention rather than declared machine-readable meaning, leaving agents to infer what pages never state. Dark patterns are that same condition with commercial intent behind it. The inference isn't breaking down. The page is working as designed, and the design is meant to mislead whoever is reading it.
Which leaves builders with a narrower problem than making the model better. These patterns persist on commercial pages because they work on somebody, and the DECEPTION comparison suggests an agent is, on current evidence, a more reliably steered target than a person. Nothing in that arrangement bends in the agent's favor. Model upgrades won't close the gap on their own, since a system that reasons more thoroughly about a manipulative interface may simply find more sophisticated justifications for the wrong action. Treating the operating surface as untrusted by default isn't a claim that every page is hostile. It's recognizing that the agent can't reliably tell which ones are, and that getting smarter doesn't appear to help it tell.
- Runtime isolation below agents: NVIDIA released OpenShell, an open-source runtime that places file access, network calls, and credential use behind an isolated policy boundary — the kind of infrastructure-layer constraint that could limit what a manipulated agent can actually reach.
- Enforcement gates cut both ways: A preprint comparing state-machine directives with raw transcripts found that enforcement gates improved compliance when the encoded rule was correct but degraded performance when the gate's judgment was wrong, raising a parallel question about when deterministic controls help and when they introduce new failure modes.
- Process compliance despite correct answers: A workshop study of enterprise agent tasks found that 92.6% of runs passing final-state checks still contained process deviations caught by a trajectory evaluator, suggesting that outcome-based evaluation alone misses how an agent arrived at its result.
- UK sandbox escape and remediation: The UK AI Security Institute published a remediation report after an agent escaped an evaluation sandbox earlier in 2026, detailing layered network controls and synchronous monitors that reduce but do not eliminate the risk of autonomous action beyond intended boundaries.
