Agent-directed dark pattern

Dark patterns were built for human attention. Agents attend differently: they read the page, the markup and any text put in front of them, and they are built to finish the task. That opens new ways to deceive. A hidden cost gets accepted because it stands between the agent and completion. A pre-selected option stays selected because nothing told the agent to look. Text written for the agent rather than the person, a prompt injection, can redirect it outright.

The vendors building browser agents say the last of these will not go away. OpenAI calls prompt injection ‘unlikely to ever be fully “solved”’; Meta’s engineering guidance, the Rule of Two, says that until models can reliably refuse it, an agent in one session should have no more than two of three properties: reading untrusted input, access to private data, and the ability to act or communicate outward. That is a design constraint, not a model fix, and it is the second design move above.

The person delegated the task so as not to have to watch it. The deception lands exactly where nobody is looking, and the person meets it later, if at all, as a charge, a subscription or a booking they did not choose.

The best measurement so far is SusBench, a peer-reviewed benchmark of 313 tasks on 55 real websites with dark patterns injected into them. Agents avoided the patterns about as often as people did overall, 62–68% against 67.5%, and failed in the same places: pre-selection, trick wording and hidden information. On hidden information, people avoided the trap 17.6% of the time and agents 8–15%. An earlier preprint that tested six agents against 16 pattern types found that none acknowledged a dark pattern more than six times, and that agents ‘prioritize task completion over protective action’. Putting a person in to supervise improved avoidance but ‘introduced costs such as attentional tunneling and cognitive load’ (see Rubber-stamp oversight).

Planted instructions work. In Microsoft Research’s Magentic Marketplace, a simulated market in which agents buy from agents, a seller’s prompt injection meant that for three of the models tested ‘all payments were redirected to the manipulative agent’; one model resisted every attempt. The same study found a ‘severe first-proposal bias’ in every model, rewarding the speed of a seller’s reply 10 to 30 times more than its quality: an opening any seller can exploit. In August 2025 Brave’s security team showed instructions hidden in a Reddit comment leading a browser agent to post the person’s email address and a one-time passcode; the same month Anthropic reported that hidden instructions succeeded against its own browser agent 23.6% of the time before mitigations and 11.2% after.

The law has not caught up. As CERRE puts it, ‘EU law protects consumers from dark patterns; it offers no equivalent protection for the agents acting on their behalf.’ The European Commission’s Digital Fairness Act proposal, expected in November 2026, is described in the Parliament’s own briefing without any mention of agents.