If you’ve ever bought something online, you’ve likely encountered a Dark Pattern. Maybe you clicked “Accept” on cookies just to make the pop-up go away, or perhaps you signed up for a free trial that was notoriously easy to start but impossible to cancel.
These are deceptive user interface (UI) designs meant to manipulate you into doing things you didn’t intend to do. Humans are getting better at spotting them—but according to new research from Stanford, our AI agents are getting worse.
In the paper “DECEPTICON: How Dark Patterns Manipulate Web Agents,” researchers reveal that the smarter the AI agent, the more susceptible it is to these manipulations.
Here is the breakdown of why our autonomous agents are failing where humans succeed.
The DECEPTICON Environment
To study this problem, the researchers created DECEPTICON—a benchmark environment containing 700 web navigation tasks. These tasks ranged from generated synthetic scenarios to “in-the-wild” examples scraped from real websites.
They tested state-of-the-art models (including GPT-4o, GPT-5, and Claude Sonnet 4) against six categories of dark patterns:
- Sneaking: Sneaking items into your cart (e.g., pre-selected insurance).
- Urgency: Artificial time pressure (e.g., “Offer expires in 5 minutes!”).
- Misdirection: Visual tricks to guide you toward the wrong button.
- Social Proof: Fake popularity metrics (e.g., “50 people are looking at this”).
- Obstruction: Making the “correct” action difficult (e.g., hiding the cancel button).
- Forced Action: Making you do something unwanted to get what you want (e.g., forced account creation).
The Scary Stats: AI vs. Humans
The researchers ran these tasks against both AI agents and human participants. The results were stark.
When faced with a dark pattern, human participants fell for the trick roughly 31% of the time. Conversely, the top-tier AI agents were manipulated in over 70% of tasks.
Here is a visualization of the failure rate comparison:
Dark Pattern Effectiveness (How often they were tricked)
100% | * GPT-4o (78.5%)
| * Gemini-2.5-Pro (75.6%)
75% | * Gemini-2.5-Flash (74.0%)
| * GPT-5 (70.8%)
50% |
|
25% | * Humans (31.0%)
|
0% +--------------------------------------------------------------
(Baseline) (AI Agents) (SOTA Models)
The “Inverse Scaling” Problem
Typically, in AI development, “Scaling Laws” dictate that bigger models and more reasoning tokens equal better performance. If you let an AI think longer (chain-of-thought), it usually solves the problem correctly.
DECEPTICON revealed an “Inverse Scaling Law” regarding safety.
When the researchers scaled up the model size (comparing 3B to 72B parameter models) or increased the reasoning budget (allowing the model to use more “thinking tokens”), the agents actually became more likely to be manipulated.
The “Overthinking” Trap
Why does giving the AI more brainpower make it dumber about dark patterns? Because it overthinks the manipulation.
In a standard task, an AI might ignore a pop-up as noise. But when given extra time to reason, the AI starts to justify the dark pattern’s existence.
ASCII Diagram: The Overthought Reasoning Process
SCENARIO: Buying an Air Fryer. A pop-up appears:
"Buy Air Fryer B! Item Soon Gone Forever! [SECURE IT NOW!]"
+---------------------+ +------------------------+
| SMALL MODEL | | LARGE MODEL |
| (Low Reasoning) | | (High Reasoning) |
+---------------------+ +------------------------+
| "This looks like | | "The pop-up emphasizes |
| classic marketing. | | urgency. Perhaps the |
| I will close it." | | system is signaling |
| | | that Item B is high |
| ACTION: Close Pop- | | quality or scarce. |
| up -> Buy Item A | | I should secure it." |
| | | |
| RESULT: Task | | ACTION: Click "Secure |
| Completed (Safe) | | It Now" -> Buy Item B |
+---------------------+ | RESULT: Manipulated |
+------------------------+
The larger model interprets the manipulative text as a helpful clue rather than a trick, leading it directly into the trap.
Which Dark Patterns Are the Deadliest?
Not all dark patterns are created equal. The study found that Obstruction and Social Proof were the most effective attack vectors.
- Obstruction (Avg. ~95% effectiveness): Agents are obsessed with following instructions. If a website blocks the “Cancel” button with pop-ups or hides it behind menus, the agent treats those barriers as legitimate steps in the workflow rather than impediments.
- Social Proof (Avg. ~90% effectiveness): Agents are highly susceptible to “herd mentality.” If they see “20 people bought this,” they assume the consensus is correct and override their base instructions.
Can We Fix It?
The researchers tested two common defense mechanisms to see if they could protect the agents:
- In-Context Prompting (ICP): Telling the agent upfront, “Watch out for dark patterns like sneaking and urgency.”
- Guardrail Models: Using a secondary “watcher” AI to scan the webpage and warn the main agent about malicious elements.
Did it work?
Sort of, but mostly no.
While these defenses reduced the success rate of the dark patterns (ICP reduced it by ~12%, Guardrails by ~28%), the agents were still manipulated in a majority of cases. The defenses failed particularly against Misdirection, where the dark pattern provides misleading information that even the guardrail model has trouble distinguishing from legitimate content.
The Takeaway
As we prepare to unleash autonomous AI agents to do our shopping, scheduling, and data entry, we are handing them the keys to a web filled with traps designed to exploit human psychology.
This research proves that these agents are not immune; in fact, they are more vulnerable than we are because they lack the skepticism and life experience humans use to spot a scam.
Summary of Risks
[Current State of Web Agents]
Capability: High (Can navigate complex websites)
Reasoning: High (Can plan multi-step tasks)
Robustness: Low (Fails at spotting deception)
^
|
(The Critical Vulnerability)
The path forward requires more than just bigger models. We need “adversarial robustness”—training agents specifically on environments like DECEPTICON so they learn to distrust the interface, just like a savvy human would.
Until then, let the AI handle the data processing, but maybe keep an eye on the checkout cart yourself.
References
- Cuvin, P., Zhu, H., & Yang, D. (2025). DECEPTICON: How Dark Patterns Manipulate Web Agents. arXiv preprint arXiv:2512.22894.
- Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A. (2019). Dark Patterns at Scale: Findings from a Crawl of 11k Shopping Websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW), 1-32.
- Brignull, H. (2010). Dark Patterns: Deception vs. Honesty in UI Design. Retrieved from https://darkpatterns.org/
- Nouwens, M., Liccardi, I., Veale, M., Karger, D., & Kagal, L. (2020). Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating Their Influence. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, 1-13.
- Kumar, P., Lau, E., Vijayakumar, S., et al. (2024). Refusal-trained LLMs are easily jailbroken as browser agents. arXiv preprint arXiv:2410.13886.