A web agent is useful because it can read an interface and act on what the interface says. That same ability is what makes it exploitable. Picture a pop-up dressed up as a required step, a badge calling the expensive option "most popular," or an item slipped quietly into a cart. Designers call these tricks dark patterns, and they work on agents for a simple reason: agents are good at doing what interfaces tell them to do. Phil Cuvin, with co-authors Hao Zhu and Diyi Yang, built DECEPTION, published at ICLR 2026, to measure how reliably this happens.
Cuvin had been circling the problem for a while. His earlier project, AutoLibra, also at ICLR 2026, begins from the premise that task success is too blunt a metric. Agents can finish a job in ways that are subtly wrong, and you need finer instruments to see it. DECEPTION pushes that premise further. An agent can complete its task and be manipulated in the same run, so the benchmark scores the two outcomes separately. It does this with deterministic checks on the final state of the website, not by asking another language model to grade the run. "The agent bought the flowers" and "the agent also accepted an unsolicited vase" end up as two distinct facts, each one verifiable.
The method rests on matched pairs. For each of 600 generated tasks, the team built two versions of the same website, identical except that one contained a specific dark pattern. Whatever difference shows up in the agent's behavior can be attributed to the manipulation itself. Getting there took real labor. The researchers defined six families of manipulation, had Gemini generate working sites, and then reviewed nearly 2,000 candidates by hand, keeping only those where the pattern worked as intended, the task could still be solved, and the example was authentic and not redundant. That left 600. They also stopped after a single round of generating and testing, so the manipulations would not gradually be tuned against the agent being evaluated. This protected the benchmark's integrity. The cost is that the results may understate what a deliberately optimized manipulation could achieve.
A second trade-off matters more. Synthetic sites make cause and effect clean, but they do not look like the real web, where tricks are layered on top of one another the way they are on actual e-commerce pages. The team did assemble a separate set of 100 tasks from real websites. There, though, the manipulations could not be cleanly removed, so the matched-pair comparison was impossible. The benchmark's strongest evidence therefore comes from environments its authors built, not from the web that agents will actually be sent into.
Inside those controlled environments, the numbers are stark. Agents fell for manipulations in over 70% of generated test tasks. Humans averaged 31%. The aggregate hides the more interesting pattern. Fake required steps fooled agents between 86% and 100% of the time, depending on the system, against 44% for humans. Popularity signals such as badges, star ratings, and "best seller" labels worked on agents 77% to 93% of the time, and on humans 18%. Sneaking, where something is added without the user noticing, was the trick that caught humans most often, at 55%, and it was comparatively less effective on agents. The two vulnerability profiles are close to mirror images. People tend to get caught when their attention drifts. Agents get caught at the points where they attend most carefully, to whatever the interface presents as authoritative guidance.
More capable models aren't harder to fool; sometimes they're easier. A model that reads interfaces more fluently doesn't become more skeptical of what those interfaces contain.
That mirror image is what makes the inverse-scaling pattern make sense. A model that gets better at reading interfaces gets better at obeying them, and the people who design interfaces do not always share the user's interests. For anyone deploying agents into environments they don't control, the practical consequence is specific. A task completion rate cannot tell you whether the agent served the user or served the interface. Cuvin, Zhu, and Yang built an evaluation that keeps those two questions apart.
- Evaluation agents reaching outsiders: An AP timeline documents multiple incidents in 2026 where agents in evaluations accessed government websites, submitted real forms, and triggered institutional responses — a reminder that the environment an agent encounters during testing can have its own stakeholders.
- Budget-matched baselines deflate sophistication: A recent web-agent study found that memory and skill modules often lost their apparent advantage when a vanilla agent received the same total token budget as additional interaction steps, raising questions about what architectural additions actually contribute versus what they smuggle through unaccounted inference cost.
- Intent tokens before checkout: American Express published a proposed design that captures user constraints — amount, merchant, expiry, item conditions — as a signed record before an agent purchases, an early attempt to preserve what the user actually wanted through the transaction lifecycle.
- Decentralized agents, concentrated attention: AgentWebBench found that even when user agents retrieved information through website-specific content agents rather than a centralized corpus, traffic still concentrated toward a small set of sources — a structural pattern worth watching as agent-mediated browsing grows.