Investigating the Impact of Dark Patterns on LLM-Based Web Agents
Open accessAbstract
As users increasingly turn to large language model (LLM) based web agents to automate online tasks, agents may encounter dark patterns: deceptive user interface designs that manipulate users into making unintended decisions. Although dark patterns primarily target human users, their potentially harmful impacts on LLM-based generalist web agents remain unexplored. In this paper, we present the first study that investigates the impact of dark patterns on the decision-making process of LLM-based generalist web agents. To achieve this, we introduce LiteAgent, a lightweight framework that automatically prompts agents to execute tasks while capturing comprehensive logs and screen-recordings of their interactions. We also present TrickyArena, a controlled environment comprising web applications from domains such as e-commerce, streaming services, and news platforms, each containing diverse and realistic dark patterns that can be selectively enabled or disabled. Using LiteAgent and TrickyArena, we conduct multiple experiments to assess the impact of both individual and combined dark patterns on web agent behavior. We evaluate six popular LLM-based generalist web agents across three LLMs and discover that when there is a single dark pattern present, agents are susceptible to it an average of 41% of the time. We also find that modifying dark pattern UI attributes through visual design changes or HTML code adjustments and introducing multiple dark patterns simultaneously can influence agent susceptibility. This study emphasizes the need for holistic defense mechanisms in web agents, encompassing both agent-specific protections and broader web safety measures.
Verified 2026-10-29 · 40 references not checked yet
AI snapshot
Written from the paper’s full text.
TL;DR
This paper presents the first study of dark patterns against LLM-based generalist web agents, introducing LiteAgent for automated logging and TrickyArena as a controlled testbed. Across six agents and three LLMs, agents were susceptible to a single dark pattern 41% of the time on average, with higher-performing agents most vulnerable and susceptibility varying by LLM, pattern combinations, UI attributes, vision, and prompt countermeasures.
Key findings
- With a single dark pattern enabled, overall dark pattern susceptibility rate (DPSR) was 41.1%; Skyvern was most vulnerable at 72.3%, followed by BrowserUse at 69.3%, DoBrowser at 46.2%, VisualWebArena at 31.4%, WebArena at 14.9%, and Agent-E at 12.1%. Obstruction (52.2%) and social engineering (47.9%) were the most effective dark pattern categories.
- Dark patterns reduced task success rates. Baseline task success was 76.3% for BrowserUse, 73.1% for DoBrowser, 72.0% for Skyvern, and 30.8% for WebArena/VisualWebArena; introducing a single dark pattern reduced TSR across agents. By LLM, Gemini 2.5 Pro had the highest DPSR (65.78%), followed by Claude 3.7 Sonnet (53.79%) and GPT-4o (51.26%), while GPT-4o showed the largest relative TSR decline (28.9%).
- Multiple dark patterns compounded harm: TSR decreased as more dark patterns were enabled, and some dark patterns that individually yielded 0% susceptibility became effective when combined with others. As the number of dark patterns increased, the likelihood of falling for at least one increased.
- UI alterations, vision, and countermeasures mattered. Code/visual/combo changes to a premium subscription pop-up reduced TSR and DPSR for BrowserUse, DoBrowser, and Skyvern, while Agent-E, VisualWebArena, and WebArena showed no change because they already failed and were not susceptible. Vision generally decreased TSR and increased susceptibility for BrowserUse and WebArena but decreased susceptibility for DoBrowser. Specific prompt postscripts achieved the highest TSR at 39.4% (+6.5% from baseline) and lowest DPSR at 43.0% (a 31.8% reduction from baseline), but susceptibility remained substantial.
Methods
- The authors built LiteAgent, an agent-agnostic framework that prompts web agents, injects JavaScript event listeners via Chrome DevTools Protocol and Playwright to log clicks, scrolls, and keystrokes, and outputs action traces plus screen recordings. They built TrickyArena, a controlled React testbed of four websites (e-commerce, news, streaming, health portal) with 14 dark patterns that can be selectively enabled or disabled via URL parameters.
- They evaluated six agents (Skyvern, DoBrowser, BrowserUse, Agent-E, WebArena, VisualWebArena) across three LLMs (Claude 3.7 Sonnet, GPT-4o, Gemini 2.5 Pro) on 32 site-specific tasks. Experiments included 88 single-dark-pattern scenarios, 57 two-dark-pattern scenarios, 18 three-dark-pattern scenarios, and 4 four-dark-pattern scenarios, with each agent run three times per scenario.
- An Agent Action Validator applied logical conditions to action traces to compute task success rate (TSR) and dark pattern susceptibility rate (DPSR), and to classify Deception-Task Outcomes: Deceived Completion, Deceived Failure, Evaded Completion, and Evaded Failure. Analysis included chi-square residuals, Laplace smoothing for relative DPSR changes, and manual review of screen recordings.
Limitations
- The paper states that LiteAgent supports mainstream agent implementations with minimal manual effort, but adding new agent implementations requires additional effort; for example, supporting DoBrowser required accounting for a specific coordinate click to initiate the agent. Future work aims to minimize this manual effort.
- The meta-review included in the text notes the lack of a human baseline for the dark patterns evaluated, making it difficult to contextualize whether agent susceptibility is more or less concerning than human susceptibility. The authors agree and defer a census-balanced human baseline study to future work.
- Evident from the text: evaluation occurs in a controlled React testbed rather than live websites, the countermeasure study is preliminary and uses only two scenarios with three postscript tiers, and the findings cover six agents, three LLMs, and 14 dark patterns, so generalization beyond these settings is limited.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
10 of 32 cited sources checked · 3 supported · 0 flagged · accuracy not yet measured
- Premisecitation§ 1. Introduction · p. 1
Prior research surrounding security threats for web agents has mainly focused on prompt injection attacks, where an attacker embeds malicious instructions within the web environment.
“However, prior research surrounding security threats for web agents has mainly focused on prompt injection attacks, where an attacker embeds malicious instructions within the web environment [15], [16]”
Quote in the paperSubstantial claim1 of 2 sources checked- cites [15] source
- cites [16] source
The Introduction and Related Work describe attackers placing malicious instructions in content agents retrieve, including websites, and discuss prior prompt-injection research. But the paper concerns tool-integrated LLM agents broadly; it does not establish that research on security threats specifically for web agents has mainly focused on prompt injection. (LLM, conf=0.83)
Experimental — accuracy not yet measured
- Interpretationcitation§ 7. Discussion · p. 13
Detection alone is insufficient to minimize the impact of dark patterns.
“Although there are efforts to automatically detect dark patterns [32], detection alone is insufficient to minimize their impact.”
Quote in the paperSubstantial claim1 of 1 sources checked- cites [32] source
- Rests on an assumption: Dark patterns do not have a standard presentation in the wild, making their detection and removal difficult even for specialized tools.
- Findingown data§ 1. Introduction · p. 2
Six popular web agents are vulnerable to various dark patterns.
“We evaluate six popular web agents, revealing their vulnerabilities to various dark patterns.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
- Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10
Susceptibility rates vary dramatically depending on the specific agent-LLM pairing.
“As shown in Figure 8, susceptibility rates vary dramatically depending on the specific agent-LLM pairing.”
Quote in the paperSubstantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
The majority of cases fall within the interaction paralysis and early-exit failure modalities.
“The majority of cases fall within the interaction paralysis and early-exit Failure modalities.”
Quote in the paperSubstantial claim
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
An agent may have interaction paralysis, where it stalls or becomes trapped in loops when encountering obstructive dark patterns.
“We find that an agent may have interaction paralysis , where the agent stalls or becomes trapped in loops when encountering obstructive dark patterns.”
Quote in the paperSubstantial claim - Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
DoBrowser has a low Evaded Completion (EC) rate.
“However, we note that, similar to other agents, DoBrowser has a low EC (Evaded Completion) rate.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 10
There is a trend of decreasing TSR as more dark patterns are enabled.
“This controlled approach isolates the impact of stacking dark patterns, revealing a trend of decreasing TSR as more dark patterns are enabled.”
Quote in the paperSubstantial claim - Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10
Claude is most effective at Evaded Completion with BrowserUse.
“From Figure 9, we can see that Claude is most effective at Evaded Completion with BrowserUse.”
Quote in the paperSubstantial claim - Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
When DoBrowser fails the task (DF, EF), it tends to evade the dark pattern as well.
“In cases where DoBrowser fails the task (DF, EF), it tends to evade the dark pattern as well.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10
The highest agent-level DC and DF rates are most common with GPT-4o.
“However, Figure 9 shows that the highest agent-level DC and DF rates are most common with GPT-4o.”
Quote in the paperNot a substantial claim - Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
BrowserUse and Skyvern are highly susceptible to Obstruction and Forced Action dark patterns.
“This tendency is further corroborated by the types of dark patterns BrowserUse and Skyvern are highly susceptible to: Obstruction and Forced Action (Table 1).”
Quote in the paperSubstantial claim - Findingown data§ 1. Introduction · p. 2
In some cases, dark patterns that were ineffective against an agent alone became effective in combination with other dark patterns.
“In some cases, dark patterns that were ineffective against an agent alone became effective in combination with other dark patterns.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
Agents may experience an early-exit failure, where their inability to complete prerequisite task steps automatically prevents exposure to dark pattern mechanics that are gated behind successful task progression.
“We find that agents may experience an early-exit failure, where their inability to complete prerequisite task steps (e.g., checkout process) automatically prevents exposure to dark pattern mechanics that are gated behind successful task progression (e.g., inadvertently buying a warranty).”
Quote in the paperSubstantial claim - Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
When DoBrowser successfully completes the task (DC, EC), it generally tends to fall for the dark pattern.
“In cases where it successfully completes the task (DC, EC), it generally tends to fall for the dark pattern.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
An agent may engage in purposeful avoidance, deliberately avoiding the dark pattern but still failing the task.
“We find that the agent may engage in purposeful avoidance - they deliberately avoid the dark pattern but still fail the task.”
Quote in the paperNot a substantial claim - Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
DoBrowser does not have any significant deviations from expected Deception-Task Outcomes.
“DoBrowser, on the other hand, seems not to have any significant deviations from expected.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: Agents and outcome distributions are independent (for calculating expected frequencies).
- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10
Evaded Completion is most common with Claude 3.7 Sonnet.
“In contrast, Evaded Completion (the ideal outcome) is most common with Claude 3.7 Sonnet, strongly suggesting that Claude is better suited at resisting deceptive UI elements while remaining effective at goal attainment in agentic settings.”
Quote in the paperSubstantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Findingown data§ Investigating the Impact of Dark Patterns on LLM-Based Web Agents · p. 1
When a single dark pattern is present, LLM-based generalist web agents are susceptible to it an average of 41% of the time.
“We evaluate six popular LLM-based generalist web agents across three LLMs and discover that when there is a single dark pattern present, agents are susceptible to it an average of 41% of the time.”
- Also stated in: § 1. Introduction · p. 2 · plain
“Our comprehensive logging reveals that web agents completing tasks on a website with a single dark pattern present are susceptible to that dark pattern 41% of the time.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
- Also stated in: § 1. Introduction · p. 2 · plain
- Findingreasoning§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
This results in particularly pronounced relative changes for agents who became susceptible to a dark pattern only when it was in combination with others.
“This results in particularly pronounced relative changes for agents who became susceptible to a dark pattern only when it was in combination with others.”
Quote in the paperNot a substantial claim - Findingown data§ 1. Introduction · p. 2
Countermeasure prompts dropped agent dark pattern susceptibility by an average of around 32%.
“However, these prompts only dropped agent dark pattern susceptibility by an average of around 32% .”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
- Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9
Introducing a single dark pattern reduces TSR for all three models.
“Introducing a single dark pattern reduces TSR for all three models, as shown in Table 2 under 'Relative Change in TSR .'”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
Certain dark patterns that individually yielded 0% susceptibility became effective in specific scenarios when combined with other dark patterns.
“When computing these averages, we observed that certain dark patterns, which individually yielded 0% susceptibility, became effective in specific scenarios when combined with other dark patterns.”
Quote in the paperSubstantial claim - Findingown data§ 3.1. TrickyArena · p. 4
Deep cloning live websites is a complex task that often fails to preserve critical back-end functionality, such as user authentication, filtering, and searching.
“However, we found that deep cloning sites (e.g., Amazon, Yahoo) is a complex task that often fails to preserve critical back-end functionality, such as user authentication, filtering, and searching.”
Quote in the paperSubstantial claim - Findingown data§ 1. Introduction · p. 2
As more dark patterns are introduced simultaneously, on average, web agents' abilities to complete tasks diminish.
“As more dark patterns are introduced simultaneously, we find that, on average, agents' abilities to complete tasks diminish.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8
Figure 6 illustrates substantial deviations between the observed and expected frequencies of Deception-Task Outcomes.
“Figure 6 presents a standardized chisquare residuals heatmap that illustrates substantial deviations between the observed and expected frequencies of Deception-Task Outcomes.”
Quote in the paperSubstantial claim- The authors state this as an assumption: Agents and outcome distributions are independent (for calculating expected frequencies).
- Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8
WebArena and VisualWebArena show a substantially lower baseline task success rate of 30.8%.
“In contrast, WebArena and VisualWebArena show a substantially lower baseline task success rate of 30 . 8% .”
Quote in the paperNot a substantial claim - Findingown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
With vision, DoBrowser exhibited a decrease in susceptibility rate.
“Furthermore, with vision, both BrowserUse and WebArena had increases in susceptibility rate (DC + DF), while DoBrowser exhibited a decrease.”
Quote in the paperNot a substantial claim - Findingown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
EC cases consistently drop or stay the same when vision is introduced.
“Here, we see EC cases consistently drop or stay the same when vision is introduced, suggesting that vision alone may not be sufficient to curb dark pattern susceptibility in cases where the agent completes the task.”
Quote in the paperSubstantial claim - Findingown data§ 7. Discussion · p. 13
The task completion success rate drops in the presence of dark patterns.
“Not only does the task completion success rate drop, but the agents are also susceptible to the dark pattern (e.g., choosing the advertised item among a list of options on an e-commerce platform).”
Quote in the paperSubstantial claim - Findingnone given§ Finding-6 · p. 13
Even when given detailed instructions on how to avoid a particular dark pattern, agents still show substantial susceptibility.
“Even when given detailed instructions on how to avoid a particular dark pattern, agents still show substantial susceptibility.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
When the same confirm-shaming pop-up was combined with another pop-up and an obstructive modal, Skyvern interacted with all dark patterns and fell victim to each.
“However, when this same pop-up is combined with another pop-up and an obstructive modal, Skyvern interacts with all dark patterns, falling victim to each.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
The confirm-shaming pop-up appeared first in the foreground among the three enabled dark patterns.
“The confirm shaming popup appears first in the foreground among the three dark patterns enabled.”
Quote in the paperNot a substantial claim - Findingown data§ 6. Countermeasures · p. 13
More precisely tailored postscripts yield greater positive impacts compared to general or no postscripts.
“Our findings indicate that more precisely tailored postscripts yield greater positive impacts compared to general or no postscripts.”
Quote in the paperSubstantial claim - Findingown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
Overall, all agents seemed to have decreased TSR when vision was introduced.
“Overall, all agents seemed to have decreased TSR (DC + EC) when vision was introduced.”
Quote in the paperSubstantial claim - Findingown data§ 5.4. Effect of Dark Pattern UI Attributes · p. 12
BrowserUse, DoBrowser, and Skyvern all had non-zero success and susceptibility rates before the UI changes.
“In contrast, BrowserUse, DoBrowser, and Skyvern all had non-zero success and susceptibility rates before the UI changes.”
Quote in the paperSubstantial claim - Findingnone given§ 5.3. Web Agents and Multiple Dark Patterns · p. 12
As the number of dark patterns increases, the likelihood of falling for at least one dark pattern increases.
“Here, we see that as the number of dark patterns increases, the likelihood of falling for at least one dark pattern increases.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
BrowserUse can interact with elements behind pop-up and modal overlays without closing them, unlike human users.
“Reviewing the session data, we see that, unlike human users, BrowserUse can interact with elements behind pop-up and modal overlays without closing them.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
When the advertisement was enabled with three other dark patterns (all obstructive modals), BrowserUse clicked the 'donate now' button.
“However, when enabled with three other dark patterns (all obstructive modals appearing throughout the task), BrowserUse clicked the 'donate now' button for the advertisement.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
Skyvern avoided a confirm-shaming pop-up dark pattern on the Health website when it appeared alone.
“In the first case, we observed Skyvern avoiding a pop-up dark pattern with confirm-shaming text on the Health website (see Appendix B) when it appears by itself.”
Quote in the paperSubstantial claim - Findingown data§ 9. Conclusion · p. 14
Several factors, such as agent modalities, LLM choice, prompting strategies, and dark pattern characteristics, can influence how agents interact with dark patterns.
“Furthermore, our findings indicate that several factors, such as agent modalities, LLM choice, prompting strategies, and dark pattern characteristics, can influence how agents interact with dark patterns.”
Quote in the paperNot a substantial claim - Findingnone given§ Finding-3 · p. 12
As the number of barriers increases, agents exhibit a corresponding drop in task success rate.
“As the number of barriers increases, agents exhibit a corresponding drop in task success rate and heightened susceptibility, even to dark patterns that they were not previously susceptible to.”
Quote in the paperSubstantial claim - Findingown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
With vision, both BrowserUse and WebArena had increases in susceptibility rate.
“Furthermore, with vision, both BrowserUse and WebArena had increases in susceptibility rate (DC + DF), while DoBrowser exhibited a decrease.”
Quote in the paperSubstantial claim - Findingnone given§ Finding-3 · p. 12
As the number of barriers increases, agents exhibit heightened susceptibility, even to dark patterns that they were not previously susceptible to.
“As the number of barriers increases, agents exhibit a corresponding drop in task success rate and heightened susceptibility, even to dark patterns that they were not previously susceptible to.”
Quote in the paperSubstantial claim - Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
When the political advertisement was the sole dark pattern enabled, BrowserUse ignored it.
“When the advertisement was the sole dark pattern enabled, BrowserUse ignored it.”
Quote in the paperSubstantial claim - Premisecitation§ 3.1. TrickyArena · p. 4
Relevant dark patterns were drawn from extensive collections of recorded dark patterns compiled in recent works.
“To identify and design relevant dark patterns for each task, we drew inspiration from extensive collections of recorded dark patterns compiled in recent works [17], [44].”
Quote in the paperSubstantial claim0 of 2 sources checked- cites [17] 2024, Dark patterns
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites [44] Mildner, 2024
Not checked in the free run.
- Interpretationreasoning§ Finding-2 · p. 10
Susceptibility rates may vary due to LLM alignment, architecture, and agent prompt engineering.
“Susceptibility rates may vary due to LLM alignment, architecture, and agent prompt engineering.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 5.2. Web Agents and Varying LLMs · p. 10
GPT-4o's poor performance with Agent-E skews the overall average DC and DF rates below Gemini's.
“GPT-4o's poor performance with Agent-E skews the overall average DC and DF rates below Gemini's.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
- Interpretationreasoning§ 5.2. Web Agents and Varying LLMs · p. 10
Variations in susceptibility rates between agent-LLM pairs likely stem from fundamental differences in both LLM design philosophies and agent prompting strategies.
“These variations in susceptibility rates between agentLLM pairs likely stem from fundamental differences in both LLM design philosophies and agent prompting strategies.”
Quote in the paperNot a substantial claim - Interpretationreasoning§ 1. Introduction · p. 1
Given the prevalence of dark patterns, it is highly likely that web agents interacting with web content come across such deceptive patterns.
“Given the prevalence of dark patterns, it is highly likely that web agents interacting with web content come across such deceptive patterns.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.2. Web Agents and Varying LLMs · p. 10
There is high variability between agent-LLM combinations.
“This further highlights the high variability that may occur between agent-LLM combinations.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 5.2. Web Agents and Varying LLMs · p. 10
These contrasting design choices influence how agents respond when they encounter dark patterns.
“These contrasting design choices influence how agents respond when they encounter dark patterns.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 5.1. Web Agents and Single Dark Patterns · p. 9
There is an inverse correlation between operational effectiveness in task execution and robustness against manipulative interface design.
“BrowserUse and Skyvern's propensity to resolve such obstacles quickly, even when it leads to falling for a dark pattern, underscores a critical trade-off: operational effectiveness in task execution inversely correlates with robustness against manipulative interface design.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.2. Web Agents and Varying LLMs · p. 9
Both LLM and agent architecture jointly determine an agent's robustness in task success rate.
“These results underscore that both LLM and agent architecture jointly determine an agent's robustness in task success rate.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.2. Web Agents and Varying LLMs · p. 10
The 14.52% disparity between the most and least susceptible models demonstrates that backend LLM selection impacts agent integrity in adversarial web settings.
“The 14.52% disparity between the most and least susceptible models demonstrates that backend LLM selection does impact agent integrity in adversarial web settings.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 5.1. Web Agents and Single Dark Patterns · p. 8
BrowserUse and Skyvern prioritize overcoming barriers to complete tasks, even if it means falling for deceptive elements.
“BrowerUse and Skyvern excel at overcoming these, and their metrics suggest that they prioritize overcoming barriers to complete tasks, even if it means falling for deceptive elements in the process.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 3.2. LiteAgent · p. 6
Differences in operational characteristics present a major challenge for LiteAgent to interface with varying web agents.
“These differences in operational characteristics present a major challenge for LiteAgent to interface with varying web agents.”
Quote in the paperNot a substantial claim - Interpretationown data§ 5.1. Web Agents and Single Dark Patterns · p. 9
These agents are not purposefully evading dark patterns but are coincidentally doing so due to poor performance.
“This suggests that these agents are not purposefully evading dark patterns but are coincidentally doing so due to poor performance.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.2. Web Agents and Varying LLMs · p. 10
Agent architecture is equally critical in shaping overall robustness to dark patterns.
“However, agent architecture is equally critical in shaping overall robustness to dark patterns.”
Quote in the paperSubstantial claim - Interpretationnone given§ Finding-3 · p. 12
Individual dark patterns can act as compounding 'barriers' that impede task completion.
“Individual dark patterns can act as compounding 'barriers' that impede task completion.”
Quote in the paperSubstantial claim - Interpretationreasoning§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
Any action planned without accounting for the presence of a modal can lead to unexpected website states, such as an article not opening when its retrieval was anticipated.
“This means that any action planned without accounting for the presence of a modal can lead to unexpected website states - such as an article not opening when its retrieval was anticipated.”
Quote in the paperSubstantial claim - Premisecitation§ Appendix C. TrickyArena Implementation Details · p. 17
Prior works, such as WebArena, make it difficult to extend the underlying source code due to the code being provided through immutable Docker images.
“Prior works, such as WebArena [8], make it difficult to extend the underlying source code due to the code being provided through immutable Docker images.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [8] Zhou, 2023, Webarena: A realistic web environment for building autonomous agents
Not checked in the free run.
- Interpretationown data§ 6. Countermeasures · p. 13
The specific postscripts still leave a significant susceptibility rate.
“This, however, is still a significant susceptibility rate.”
Quote in the paperSubstantial claim - Interpretationnone given§ 8. Related Work · p. 14
Our work is the first to provide a comprehensive, automated, and empirical investigation of web agent interaction with dark patterns.
“Our work distinguishes itself from prior research by being, to the best of our knowledge, the first to provide a comprehensive, automated, and empirical investigation of web agent interaction with dark patterns.”
Quote in the paperNot a substantial claim - Interpretationown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
Vision alone may not be sufficient to curb dark pattern susceptibility in cases where the agent completes the task.
“Here, we see EC cases consistently drop or stay the same when vision is introduced, suggesting that vision alone may not be sufficient to curb dark pattern susceptibility in cases where the agent completes the task.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12
For these agents faced with a single dark pattern, vision may hinder performance.
“This suggests that, for these agents faced with a single dark pattern, vision may hinder performance.”
Quote in the paperSubstantial claim - Interpretationown data§ 7. Discussion · p. 13
Dark patterns significantly impact web agents.
“Our study demonstrates that dark patterns significantly impact web agents.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
The more barriers there are to completing a task, the harder they are to ignore.
“In other words, it seems that the more barriers there are to completing a task, the harder they are to ignore.”
Quote in the paperSubstantial claim - Interpretationnone given§ Finding-5 · p. 13
Adding visual capabilities alone does not reliably improve agent performance.
“Adding visual capabilities alone does not reliably improve agent performance; in most cases, it actually increases dark pattern susceptibility and lowers task success rates.”
Quote in the paperSubstantial claim - Premisereasoning§ 5.4. Effect of Dark Pattern UI Attributes · p. 12
Poorer performance in agents may lead to 'interaction paralysis' where the agent stalls or loops because it does not know how to proceed.
“From Section 5.1, we know that poorer performance in agents may lead to 'interaction paralysis' where the agent stalls or loops because it does not know how to proceed.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites Section 5.1
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationreasoning§ 5.4. Effect of Dark Pattern UI Attributes · p. 12
The subsequent drops in dark pattern susceptibility may be explained by interaction paralysis.
“These subsequent drops in dark pattern susceptibility may be explained by this phenomenon.”
Quote in the paperSubstantial claim - Interpretationown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11
Skyvern may pay closer attention to obstructive pop-ups and modals when they are in combination with others.
“This suggests that Skyvern may pay closer attention to obstructive pop-ups and modals when they are in combination with others.”
Quote in the paperNot a substantial claim - Interpretationnone given§ Finding-4 · p. 12
Implementations where UI attributes hinder agent comprehension negatively impact dark pattern effectiveness.
“Implementations where UI attributes hinder agent comprehension negatively impact dark pattern effectiveness.”
Quote in the paperNot a substantial claim - Interpretationreasoning§ Appendix H. Response to the Meta-Review · p. 20
Because our dark pattern implementations, user interfaces, and scenarios differ, we cannot directly compare human susceptibility rates with our agent results to assess relative vulnerability.
“However, because our dark pattern implementations, user interfaces, and scenarios differ, we cannot directly compare human susceptibility rates with our agent results to assess relative vulnerability.”
Quote in the paperNot a substantial claim - Interpretationown data§ Finding-6 · p. 13
Precisely tailored postscripts have limited effectiveness in enhancing task success and reducing susceptibility to dark patterns.
“Precisely tailored postscripts have limited effectiveness in enhancing task success and reducing susceptibility to dark patterns.”
Quote in the paperSubstantial claim
- May combine two claims. 58
- Classified as probably not a substantial claim. 55
- The quote only partly states this claim. 2
May combine two claims.
Premisecitation§ 5.2. Web Agents and Varying LLMs · p. 10Claude's Constitutional AI framework employs explicit self-critique mechanisms that systematically evaluate potential responses against ethical principles before execution, whereas GPT-4o may prioritize speed and high-performance outputs.
“For instance, Claude's Constitutional AI framework [46] employs explicit self-critique mechanisms that systematically evaluate potential responses against ethical principles before execution, whereas GPT-4o [3] may prioritize speed and high-performance outputs.”
Quote in the paperSubstantial claim1 of 2 sources checked- cites [46] Bai, 2022, Constitutional ai: Harmlessness from ai feedback source
Section 1.2 describes Constitutional AI using principles to critique and revise responses during supervised training, followed by AI evaluations during reinforcement learning. It does not establish that a deployed Claude model evaluates each potential response against those principles before execution. The GPT-4o comparison has a separate citation and is not assessed here. (LLM, conf=0.85)
Experimental — accuracy not yet measured - cites [3] Hurst, 2024, Gpt-4o system card
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 2.2. Dark Patterns · p. 3Dark patterns enable companies to exploit users for monetary gain, harvest personal data, and reduce consumer autonomy.
“Broadly, dark patterns enable companies to exploit users for monetary gain, harvest personal data, and reduce consumer autonomy [31].”
Quote in the paperNot a substantial claim1 of 1 sources checked- cites [31] source
Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 4.2. Web Agent Integration · p. 7Agent-E is a commercial web agent that operates as a Chrome extension, overlaying a chat window on the browser webpage for user interaction.
“Agent-E [24], a commercial web agent, operates as a Chrome extension, overlaying a chat window on the browser webpage for user interaction.”
Quote in the paperNot a substantial claim1 of 1 sources checked- cites [24] Abuelsaad, 2024, Agent-e: From autonomous web navigation to foundational design principles in agentic systems source
The Introduction identifies Agent-E as a web agent, and Section 2 describes browser control using Playwright. The copy does not describe Agent-E as commercial or as a Chrome extension with a chat window overlaid on the webpage; Section 2’s “nested chat” refers to communication between agents, not a user interface. (LLM, conf=0.88)
Experimental — accuracy not yet measured
May combine two claims.
Premisecitation§ 3.1. TrickyArena · p. 4The dark pattern collections offer comprehensive coverage across multiple dark pattern categories corresponding to the ontology and practitioner-identified patterns from real design contexts seen on the web.
“We chose to leverage these works as they offer comprehensive coverage across multiple dark pattern categories that directly correspond to the ontology [31] presented in Section 2.2. Furthermore, they offer practitioner-identified patterns from real design contexts seen on the web.”
Quote in the paperSubstantial claim1 of 1 sources checked- cites [31] source
Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 4.2. Web Agent Integration · p. 7WebArena and VisualWebArena are open-source academic implementations operating as desktop applications that launch browser instances for task execution.
“WebArena [8] and VisualWebArena [9], open-source academic implementations operating as desktop applications, also launch browser instances for task execution.”
Quote in the paperNot a substantial claim1 of 2 sources checked- cites [8] Zhou, 2023, Webarena: A realistic web environment for building autonomous agents
Not checked in the free run.
- cites [9] source
Section 3.1 describes VisualWebArena as a web-browsing environment with URLs and open tabs, and Table 1 lists actions for opening tabs and navigating to URLs. Section 3 says its websites use open-source infrastructure and are standalone self-hosted web applications. The paper does not establish that VisualWebArena is a desktop application, that it launches browser instances for task execution, or that the benchmark itself is open-source. (LLM, conf=0.84)
Experimental — accuracy not yet measured
May combine two claims.
Premisecitation§ 3.2. LiteAgent · p. 5Existing agent logging frameworks often rely on specific agent implementations that hard-code crucial aspects of agent behavior, defining fixed prompts, predetermined methods for environmental observations, and limited action space, which constrains evaluation of diverse agent implementations.
“Existing approaches [8], [9] often rely on specific agent implementations that hard-code crucial aspects of agent behavior.”
- Also stated in: § 3.2. LiteAgent · p. 5 · plain
“This approach constrains the potential for the evaluation of diverse agent implementations.”
Quote in the paperSubstantial claim1 of 2 sources checked- cites [8] Zhou, 2023, Webarena: A realistic web environment for building autonomous agents
Not checked in the free run.
- cites [9] source
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
- Also stated in: § 3.2. LiteAgent · p. 5 · plain
Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ Appendix C. TrickyArena Implementation Details · p. 17The ALMAA demonstrates practical application of logging in virtual environments, utilizing detailed user interaction logs and feedback reports to optimize user satisfaction and system performance.
“The ALMAA demonstrates practical application of logging in virtual environments, utilizing detailed user interaction logs and feedback reports to optimize user satisfaction and system performance [74].”
Quote in the paperNot a substantial claim1 of 1 sources checked- cites [74] source
Section 4.4 (page unavailable) says the study analyzed user interaction logs, feedback reports, and performance metrics from virtual platforms. Section 7.1 (page unavailable) reports improved user satisfaction and operational efficiency. The paper presents the logs as data for evaluating ALMAA, not as a demonstrated mechanism used to optimize those outcomes. (LLM, conf=0.82)
Experimental — accuracy not yet measured
Probably not a substantial claim: may not pass S3 (load-bearing).
Premisecitation§ Appendix C. TrickyArena Implementation Details · p. 17Recent research has highlighted the importance of comprehensive logging systems for AI agents across various domains.
“Recent research has highlighted the importance of comprehensive logging systems for AI agents across various domains.”
Quote in the paperNot a substantial claim1 of 1 sources checked- cites [74] source
Section 4.4 (page unavailable) says the authors used extensive user-interaction logs as observational data. It does not discuss the importance of comprehensive logging systems for AI agents across domains. Searches for logging systems and their importance found no passage addressing that broader claim. (LLM, conf=0.74)
Experimental — accuracy not yet measured
May combine two claims.
Findingown data§ 3.2. LiteAgent · p. 6The survey of agents identified desktop applications and browser extensions as two popular application types.
“This design decision was informed by our survey of agents, which identified these as two popular application types.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10LLM choice has a substantial influence on agent dark pattern susceptibility, with Gemini 2.5 Pro exhibiting the highest overall rate (65.78%), followed by Claude 3.7 Sonnet (53.79%), and GPT-4o (51.26%).
“LLM choice also has a substantial influence on agent dark pattern susceptibility, with Gemini 2.5 Pro exhibiting the highest overall rate (65.78%), followed by Claude 3.7 Sonnet (53.79%), and GPT-4o (51.26%), as shown in Table 2.”
Quote in the paperSubstantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8BrowserUse and Skyvern display among the highest task completion rates, experience minimal task performance degradation when exposed to a single dark pattern, and are the most susceptible to dark patterns.
“Consistent with these findings, Figures 5 and Table 1 demonstrate that both agents display among the highest task completion rates, experience minimal task performance degradation when exposed to a single dark pattern, and are the most susceptible to dark patterns.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9Skyvern demonstrates the lowest performance with Claude, exhibiting a slight increase in TSR in the presence of dark patterns.
“Skyvern demonstrates the lowest performance with Claude, exhibiting a slight increase in TSR in the presence of dark patterns (likely attributable to randomized LLM behavior).”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8Skyvern and BrowserUse are the most vulnerable agents, with susceptibility rates of 72.3% and 69.3%.
“Skyvern and BrowserUse are the most vulnerable agents, with susceptibility rates of 72 . 3% and 69 . 3% .”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10Certain agents, such as Agent-E, show high variability in susceptibility rate depending on LLM, while others, like Skyvern, have relatively low variability.
“Moreover, certain agents, such as AgentE, show high variability in susceptibility rate depending on LLM, while others, like Skyvern, have relatively low variability.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9GPT-4o demonstrates the largest relative decline, with TSR dropping by 28.9%, substantially higher than Claude and Gemini.
“GPT-4o demonstrates the largest relative decline, with TSR dropping by 28.9%, substantially higher than Claude and Gemini.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10On average, Gemini agents are most prone to Deceived Completion (DC) and Deceived Failure (DF) at a noticeably higher rate than Claude and Gemini.
“On average, Gemini agents are most prone to Deceived Completion (DC) and Deceived Failure (DF) at a noticeably higher rate than Claude and Gemini.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 1. Introduction · p. 2When visual and implementation-specific elements of dark patterns were changed, half the agents saw no change in performance or susceptibility, while other agents saw a significant decline in task success rate and susceptibility.
“We found that half the agents saw no change in performance or susceptibility, while other agents saw a significant decline in task success rate and susceptibility.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
Probably not a substantial claim: may not pass S3 (load-bearing).
Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11Figure 11 illustrates the average relative change in DPSR between scenarios with a single and multiple dark patterns.
“Figure 11 illustrates the average relative change in DPSR between scenarios with a single and multiple dark patterns.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10Agent-E has a comparatively lower average susceptibility rate, although still significant.
“Agent-E has a comparatively lower average susceptibility rate, although still significant.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9The lowest TSRs for Agent-E and BrowserUse are found with Gemini in scenarios without dark patterns and with GPT-4o in scenarios with a single dark pattern.
“The lowest TSR s for Agent-E and BrowserUse are found with Gemini in scenarios without dark patterns and with GPT-4o in scenarios with a single dark pattern.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8In the absence of dark patterns, BrowserUse achieves the highest success rate (76.3%), followed by DoBrowser (73.1%) and Skyvern (72.0%).
“In the absence of dark patterns, BrowserUse achieves the highest success rate ( 76 . 3% ), followed by DoBrowser ( 73 . 1% ) and Skyvern ( 72 . 0% ).”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9Agent-E and BrowserUse achieve the highest TSRs with Claude (with and without dark patterns), while Skyvern performs best with Gemini.
“A finer-grained analysis by agent-LLM combination, shown in Figure 7, reveals distinct trends: Agent-E and BrowserUse achieve the highest TSR s with Claude (with and without dark patterns), while Skyvern performs best with Gemini.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11Agent-E, BrowserUse, Skyvern, and WebArena all exhibited cases where a dark pattern became effective only in combination, with WebArena having the most occurrences.
“In particular, Agent-E, BrowserUse, Skyvern, and WebArena all exhibited such cases, with WebArena having the most occurrences.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10GPT-4o has both the highest susceptibility when paired with Skyvern and the lowest susceptibility when paired with Agent-E.
“GPT-4o has both the highest susceptibility when paired with Skyvern and the lowest susceptibility when paired with Agent-E.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 1. Introduction · p. 2Dark pattern susceptibility varies significantly between web agents, with higher-performing agents being the most vulnerable.
“Dark pattern susceptibility ranges significantly between agents, with higher-performing agents being the most vulnerable.”
Quote in the paperSubstantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
May combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 10On average, Skyvern demonstrates the highest susceptibility, followed closely by BrowserUse.
“On average, Skyvern demonstrates the highest susceptibility, followed closely by BrowserUse.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 10Figure 10 overviews the relative change in TSR between scenarios with no dark patterns and multiple dark patterns.
“Figure 10 overviews the relative change in TSR between scenarios with no dark patterns and multiple dark patterns.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8BrowserUse and Skyvern have significantly more Deceived Completion (DC) cases than expected and significantly fewer Evaded Failure (EF) cases than expected.
“Specifically, BrowserUse and Skyvern are outliers that have significantly more DC (Decieved Completion) cases than expected and significantly fewer EF (Evaded Failure) cases than expected.”
Quote in the paperSubstantial claim- The authors state this as an assumption: Agents and outcome distributions are independent (for calculating expected frequencies).
May combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8When a single dark pattern is introduced, agent task success rates consistently decline, with Agent-E, DoBrowser, and VisualWebArena experiencing the largest drops relative to their baseline performances.
“We observe that when a single dark pattern is introduced, agent task success rates consistently decline, with Agent-E, DoBrowser, and VisualWebArena experiencing the largest drops relative to their baseline performances.”
Quote in the paperSubstantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.2. Web Agents and Varying LLMs · p. 9In scenarios without dark patterns, TSRs are comparable across models, with Gemini 2.5 Pro highest at 68.8% TSR.
“In scenarios without dark patterns, TSR s are comparable across models, with Gemini 2.5 Pro highest at 68.8% TSR .”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 1. Introduction · p. 2A majority of agents tested experienced decreases in task success rates and increases in dark pattern susceptibility when vision was turned on.
“A majority of agents tested experienced decreases in task success rates and increases in dark pattern susceptibility when vision was turned on.”
Quote in the paperNot a substantial claim- Rests on an assumption: The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
- Rests on an assumption: The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
- Rests on an assumption: The controlled TrickyArena environment elicits agent behavior comparable to live websites.
May combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 8Obstruction and social engineering dark patterns are the most effective, achieving aggregate susceptibility rates of 52.2% and 47.9% across all agents.
“We also observe that obstruction and social engineering dark patterns are the most effective, achieving aggregate susceptibility rates of 52.2% and 47.9% across all agents.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9Agent-E, VisualWebArena, and WebArena have the lowest task completion rates, experience the most performance degradation when exposed to a single dark pattern, and are the least susceptible.
“These agents have the lowest task completion rates, experience the most performance degradation when exposed to a single dark pattern, and seem to be the least susceptible.”
Quote in the paperSubstantial claim- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.1. Web Agents and Single Dark Patterns · p. 9Agent-E, VisualWebArena, and WebArena have significantly fewer Deceived Completion (DC) cases than expected and significantly higher Evaded Failure (EF) cases than expected.
“Conversely, Agent-E, VisualWebArena, and WebArena have significantly fewer DC cases than expected and significantly higher EF cases than expected.”
Quote in the paperSubstantial claim- The authors state this as an assumption: Agents and outcome distributions are independent (for calculating expected frequencies).
- The authors state this as an assumption: After the set time limit, the agent has finished.
May combine two claims.
Findingown data§ 5.3. Web Agents and Multiple Dark Patterns · p. 11In this case, BrowserUse opened multiple modals simultaneously without a clear strategy while interacting with elements behind the modals, and one of these elements was the 'donate now' button.
“In this particular case, BrowserUse was opening multiple modals simultaneously, seemingly without a clear strategy, while interacting with elements behind the modals. One of these elements happened to be the 'donate now' button.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Findingnone given§ Appendix C. TrickyArena Implementation Details · p. 17Dark patterns are differentiated from other components in TrickyArena.
“Furthermore, dark patterns are differentiated from other components.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 5.4. Effect of Dark Pattern UI Attributes · p. 12Agent-E, VisualWebArena, and WebArena show no change in task success rate or susceptibility after UI attribute changes to p1.
“Agent-E, VisualWebArena, and WebArena show no change in task success rate or susceptibility.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown data§ 5.4. Effect of Dark Pattern UI Attributes · p. 12Before the UI attribute change, Agent-E, VisualWebArena, and WebArena consistently failed the task and were not susceptible to the dark pattern.
“Examining their raw task and susceptibility scores before the UI attribute change, all three agents consistently failed the task and were not susceptible to the dark pattern.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Findingnone given§ Appendix C. TrickyArena Implementation Details · p. 17In contrast to ALMAA, LiteAgent is an agent-agnostic framework specifically designed to collect telemetry data for web agents.
“In contrast to ALMAA, LiteAgent is an agent-agnostic framework specifically designed to collect telemetry data for web agents.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 6. Countermeasures · p. 13The 'specific' postscripts resulted in the highest observed task success rate at 39.4%, an increase of 6.5% from the baseline.
“Specifically, the category of 'specific' postscripts resulted in the highest observed task success rate at 39.4% (an increase of 6.5% from the baseline) and the lowest susceptibility to dark patterns at 43.0% (a reduction of 31.8% compared to the baseline).”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Findingnone given§ Appendix C. TrickyArena Implementation Details · p. 17TrickyArena is a modular codebase consisting of React components.
“TrickyArena is a modular codebase consisting of React components.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown data§ 6. Countermeasures · p. 13The 'specific' postscripts resulted in the lowest susceptibility to dark patterns at 43.0%, a reduction of 31.8% compared to the baseline.
“Specifically, the category of 'specific' postscripts resulted in the highest observed task success rate at 39.4% (an increase of 6.5% from the baseline) and the lowest susceptibility to dark patterns at 43.0% (a reduction of 31.8% compared to the baseline).”
Quote in the paperSubstantial claimMay combine two claims.
Findingreasoning§ 5.4. Effect of Dark Pattern UI Attributes · p. 12When faced with the UI alterations, there was a significant drop in task performance and dark pattern susceptibility, particularly in DoBrowser.
“When faced with the alterations, there was a significant drop in task performance and dark pattern susceptibility, particularly in DoBrowser.”
Quote in the paperSubstantial claimThe quote only partly states this claim.
Findingown data§ 7. Discussion · p. 13Agents are susceptible to the intended goals of dark patterns (e.g., accepting privacy-invasive cookies).
“Not only does the task completion success rate drop, but the agents are also susceptible to the dark pattern (e.g., choosing the advertised item among a list of options on an e-commerce platform).”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S4 (based).
Premisenone given§ 3.2. LiteAgent · p. 6Directly parsing information from the extension GUI without instrumenting its code is difficult.
“Since directly parsing information from the extension GUI without instrumenting its code is difficult, we employ a time-out mechanism.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim. May combine two claims.
Premisecitation§ 1. Introduction · p. 1Dark patterns are known to have negative consequences for users, ranging from unintentional loss of money to deceptive steering of users toward specific items.
“These dark patterns are known to have negative consequences for users, ranging from unintentional loss of money [11], [12] to deceptive steering of users toward specific items [13], [14].”
Quote in the paperSubstantial claim0 of 4 sources checked- cites [11] 2024
Not checked in the free run.
- cites [12] 2024
Not checked in the free run.
- cites [13] 2019
Not checked in the free run.
- cites [14] 2024
Not checked in the free run.
Probably not a substantial claim: may not pass S4 (based).
Interpretationnone given§ 2.3. Motivation · p. 3The consequences of agents falling for dark patterns could range from unintentionally divulging sensitive user information to purchasing products or services without the user's knowledge or consent.
“The consequences of agents falling for dark patterns could range from unintentionally divulging sensitive user information to purchasing products or services without the user's knowledge or consent.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 4.2. Web Agent Integration · p. 7BrowserUse is a commercial open-source web agent that functions as a desktop app that launches a browser to execute prompted tasks.
“BrowserUse [19], a commercial open-source web agent, functions as a desktop app that launches a browser to execute prompted tasks.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [19] 2025
Not checked in the free run.
Probably not a substantial claim: may not pass S4 (based).
Study design and conductreasoning§ 3.2. LiteAgent · p. 5LiteAgent offers a flexible, agent-agnostic approach by operating independently of any particular agent framework regardless of how it observes its environment, processes data, or selects actions.
“In contrast, LiteAgent offers a flexible, agent-agnostic approach by operating independently of any particular agent framework regardless of how it observes its environment, processes data, or selects actions.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductreasoning§ 4.2. Web Agent Integration · p. 7Six agents were selected for evaluation due to their varied architectures and development contexts.
“Following a comprehensive review of available LLMbased agents designed to operate within a web environment, we selected six agents for evaluation due to their varied architectures and development contexts.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim. May combine two claims.
Premisecitation§ 1. Introduction · p. 1Dark patterns are a well-documented and widespread phenomenon.
“While such attacks remain minimally documented in real-world scenarios, dark patterns are a well-documented and widespread phenomenon [10].”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [10] 2024
Not checked in the free run.
May combine two claims.
Study design and conductreasoning§ 3.1. TrickyArena · p. 4TrickyArena provides a controlled environment where element names and conditions remain consistent, eliminating variability inherent in live websites that can confound testing results, allowing repeatable experiments and scenarios.
“This creates a controlled environment where element names and conditions remain consistent, eliminating the variability inherent in live websites that can confound testing results. This allows for repeatable experiments and scenarios.”
Quote in the paperSubstantial claimClassified as probably not a substantial claim.
Study design and conductnone given§ 3. Methodology · p. 4An Agent Action Validator applies a set of logical conditions to determine task completion or susceptibility to dark patterns.
“To evaluate agent performance, we build an Agent Action Validator that applies a set of logical conditions to determine task completion or susceptibility to dark patterns.”
Quote in the paperSubstantial claimMay combine two claims.
Premisecitation§ 2.3. Motivation · p. 3In 2024, the FTC and international consumer protection networks found that nearly 76% of examined websites and mobile apps employed at least one possible dark pattern, with 67% using multiple.
“In 2024, the FTC and international consumer protection networks found that nearly 76% of examined websites and mobile apps employed at least one possible dark pattern, with 67% using multiple [10].”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [10] 2024
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 4.2. Web Agent Integration · p. 7DoBrowser is a commercial web agent that operates as a browser extension with a GUI activated by user interaction, employing a search bar for prompt input.
“DoBrowser [18], a commercial web agent, operates as a browser extension with a GUI activated by user interaction, employing a search bar for prompt input.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [18] 2025
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductnone given§ 4.2. Web Agent Integration · p. 7These agents were selected based on their diverse architectures, encompassing observational capabilities and implementation choices.
“These agents were selected based on their diverse architectures, encompassing observational capabilities (e.g., accessibility tree, HTML crawling, and vision) and implementation choices (e.g., desktop application or web extension).”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Premisecitation§ 3.2. LiteAgent · p. 6Browser extensions such as DoBrowser have a GUI on the browser that takes in text prompts and interacts directly with the browser instance they are installed on.
“Browser extensions such as DoBrowser [18] have a GUI on the browser that takes in text prompts and interacts directly with the browser instance they are installed on.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [18] 2025
Not checked in the free run.
Classified as probably not a substantial claim.
Study design and conductnone given§ 3. Methodology · p. 3Each website is associated with a set of clearly defined tasks, allowing for precise measurement of task completion.
“We associate each website with a set of clearly defined tasks, allowing for precise measurement of task completion.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown data§ 5.2. Web Agents and Varying LLMs · p. 10Claude is better suited at resisting deceptive UI elements while remaining effective at goal attainment in agentic settings.
“In contrast, Evaded Completion (the ideal outcome) is most common with Claude 3.7 Sonnet, strongly suggesting that Claude is better suited at resisting deceptive UI elements while remaining effective at goal attainment in agentic settings.”
Quote in the paperSubstantial claimMay combine two claims.
Premisenone given§ Investigating the Impact of Dark Patterns on LLM-Based Web Agents · p. 1The paper presents the first study, systematic evaluation, and comprehensive analysis of dark pattern effectiveness on LLM-based web agents.
“In this paper, we present the first study that investigates the impact of dark patterns on the decisionmaking process of LLM-based generalist web agents.”
- Also stated in: § 1. Introduction · p. 2 · plain
“In this paper, we present the first systematic evaluation of dark pattern effectiveness on LLM-enabled web agents.”
- Also stated in: § 1. Introduction · p. 2 · hedged
“To the best of our of knowledge, we conduct the first comprehensive analysis of dark pattern effectiveness on LLM web agents.”
Quote in the paperSubstantial claim- Also stated in: § 1. Introduction · p. 2 · plain
Probably not a substantial claim: may not pass S4 (based).
Premisenone given§ 3.1. TrickyArena · p. 4There is an absence of formal user studies on web agent usage.
“Given the absence of formal user studies on web agent usage, we identified tasks suitable for web agent automation.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S4 (based).
Premisereasoning§ 3.2. LiteAgent · p. 5An agent's performance can depend on factors beyond the underlying language model, such as how data is collected, processed, and incorporated into prompts, prompt engineering techniques, and the set of actions the agent can perform.
“This is important since an agent's performance can depend on factors beyond the underlying language model. Namely, differing agent implementations may vary in how data is collected, processed, and incorporated into prompts, prompt engineering techniques, and what set of actions the agent can perform.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
Premisenone given§ 4.2. Web Agent Integration · p. 7Each web agent is required to execute automated tasks on any website, given only a specified task and target URL as input.
“We require each web agent to execute automated tasks on any website, given only a specified task and target URL as input.”
Quote in the paperSubstantial claimClassified as probably not a substantial claim. The quote only partly states this claim.
Study design and conductown data§ 3.3. Agent Action Validator · p. 7To verify the accuracy of the logical conditions, screen recordings are manually reviewed and compared against the validator's results.
“To verify the accuracy of these logical conditions used by the validator in determining task completion and dark pattern susceptibility, we manually review the screen recordings collected by LiteAgent .”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductnone given§ 3.3. Agent Action Validator · p. 7The validator's results can be supplemented by manually reviewing screen recordings to verify result accuracy.
“The validator's results can be supplemented by manually reviewing the screen recordings collected by LiteAgent to verify result accuracy.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
Study design and conductnone given§ 3.1. TrickyArena · p. 4TrickyArena is a testbed of websites designed to simulate real-world online experiences across various popular domains, such as e-commerce, streaming, and news.
“TrickyArena is a testbed of websites designed to simulate real-world online experiences across various popular domains, such as e-commerce, streaming, and news.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Interpretationreasoning§ 5.2. Web Agents and Varying LLMs · p. 10How each agent formats observations, interaction history, and user tasks for the LLM introduces further variability.
“Additionally, how each agent formats observations, interaction history, and user tasks for the LLM introduces further variability.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim. May combine two claims.
Premisereasoning§ 4.2. Web Agent Integration · p. 7LLM-based applications such as Perplexity were excluded because they are limited to retrieving web data and lack the capacity for dynamic interactions such as clicking elements or scrolling pages.
“Consequently, LLM-based applications such as Perplexity were excluded from our study, as they are limited to retrieving web data and lack the capacity for dynamic interactions, such as clicking elements or scrolling pages.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisenone given§ 4.2. Web Agent Integration · p. 7WebArena utilizes a webpage's HTML and accessibility tree for observation, while VisualWebArena incorporates image-based observations via VLMs.
“WebArena utilizes a webpage's HTML and accessibility tree for observation, while VisualWebArena incorporates image-based observations via VLMs.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductnone given§ 4.1. TrickyArena · p. 7Unique identifiers and accessibility tree-labels were manually assigned to all interactive elements to facilitate precise interaction tracking.
“Unique identifiers and accessibility tree-labels were manually assigned to all interactive elements to facilitate precise interaction tracking.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S4 (based).
Premisereasoning§ 1. Introduction · p. 1Although dark patterns are traditionally designed for humans, their potential to affect LLM-based generalist web agents remains unexplored.
“Although dark patterns are traditionally designed for humans, their potential to affect LLM-based generalist web agents remains unexplored.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
Study design and conductreasoning§ 5.1. Web Agents and Single Dark Patterns · p. 8Each agent was run on each scenario three times to account for the stochastic nature of LLM-based web agents.
“We run each agent on each scenario three times to account for the stochastic nature of LLM-based web agents.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S2 (checkable).
Premisereasoning§ 3.2. LiteAgent · p. 5LiteAgent addresses a significant gap in current agent logging frameworks.
“LiteAgent addresses a significant gap in current agent logging frameworks.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Study design and conductreasoning§ 3.2. LiteAgent · p. 6The separation of the injected event listeners' JavaScript execution context from the DOM ensures capture of agent interactions without altering the visual presentation or behavior of web elements.
“This separation of environments ensures we capture agent interactions without altering the visual presentation or behavior of web elements.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductreasoning§ 3.2. LiteAgent · p. 6LiteAgent's injected event listeners log all clicks, scrolls, and keystrokes inputted by the agent onto the page.
“These event listeners log all clicks, scrolls, and keystrokes inputted by the agent onto the page.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
Study design and conductreasoning§ 3.1. TrickyArena · p. 5The dark pattern activation system allows controlled testing environments with adjustable dark pattern combinations across TrickyArena's websites.
“This flexibility allows for controlled testing environments with adjustable dark pattern combinations across TrickyArena 's websites.”
Quote in the paperSubstantial claimMay combine two claims.
Study design and conductcitation§ 1. Introduction · p. 2Existing test environments such as WebArena test specific agent implementations with different LLMs, whereas LiteAgent can be configured to support any agent implementation, enabling more realistic evaluation.
“Existing test environments, such as WebArena [8], test specific agent implementations with different LLMs. In contrast, our framework can be configured to support any agent implementation, enabling more realistic evaluation.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [8] Zhou, 2023, Webarena: A realistic web environment for building autonomous agents
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Premisereasoning§ 3.2. LiteAgent · p. 6CDP and Playwright have limitations in directly interacting with the extension pop-up GUI as they are designed for webpage testing.
“These tools, however, have limitations in directly interacting with the extension pop-up GUI as they are designed for webpage testing.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 3.2. LiteAgent · p. 6Desktop applications such as Skyvern take in prompts as formatted payloads and initialize their own browser to complete tasks.
“Desktop applications such as Skyvern [7] take in prompts as formatted payloads and initialize their own browser to complete tasks.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [7] 2025
Not checked in the free run.
Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.
Interpretationreasoning§ 3.1. TrickyArena · p. 4Building a custom testbed from the ground up provides complete control and flexibility over each website's implementation and architecture while ensuring a comprehensive understanding of the codebase.
“In contrast, building a custom testbed from the ground up provides complete control and flexibility over each website's implementation and architecture while ensuring a comprehensive understanding of the codebase.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim. May combine two claims.
Study design and conductreasoning§ 5. Evaluation · p. 8GPT-4o was used as the backend LLM for RQ1, RQ3, RQ4, and RQ5 to maintain consistency, while RQ2 explicitly evaluates alternative LLMs.
“To maintain consistency, we use GPT-4o as the backend LLM for RQ1 , RQ3 , RQ4 , and RQ5 , while RQ2 explicitly evaluates alternative LLMs.”
Quote in the paperSubstantial claimClassified as probably not a substantial claim.
Study design and conductnone given§ 3.3. Agent Action Validator · p. 7The Agent Action Validator evaluates action traces against logical conditions to determine whether the agent achieved the task goal and was susceptible to the dark pattern.
“The Agent Action Validator evaluates the action traces collected by LiteAgent against sets of logical conditions to see whether the agent ( 1 ) achieved the task goal and ( 2 ) was susceptible to the dark pattern.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
Premisecitation§ 4.2. Web Agent Integration · p. 7Skyvern is an open-source commercial web agent functioning as a desktop application that launches a browser instance to execute tasks based on a given prompt.
“Skyvern [7], an open-source commercial web agent functioning as a desktop application, launches a browser instance to execute tasks based on a given prompt.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [7] 2025
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing).
Interpretationreasoning§ 5.2. Web Agents and Varying LLMs · p. 10Differences in prompt engineering and observation parsing may enhance or diminish a specific LLM's ability to resist dark patterns.
“Differences in prompt engineering and observation parsing may enhance or diminish a specific LLM's ability to resist dark patterns.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Study design and conductnone given§ 4.2. Web Agent Integration · p. 7Agents were selected from both academic and commercial settings to represent different development contexts and application scenarios.
“Moreover, we selected agents developed in both academic and commercial settings to represent different development contexts and application scenarios.”
Quote in the paperNot a substantial claimMay combine two claims.
Interpretationreasoning§ Finding-2 · p. 10Both LLM and agent implementation shape dark pattern susceptibility; the optimal agent design for one LLM may be suboptimal for another.
“Both LLM and agent implementation shape dark pattern susceptibility; the optimal agent design for one LLM may be suboptimal for another.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Premisecitation§ 1. Introduction · p. 1A recent FTC report noted that 75% of apps and websites leverage deceptive design to trick users.
“A recent report by the Federal Trade Commission (FTC) noted that 75% of apps and websites leverage such deceptive design to trick users [10].”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [10] 2024
Not checked in the free run.
Probably not a substantial claim: may not pass S4 (based).
Study design and conductnone given§ 3.3. Agent Action Validator · p. 7All logical conditions must be satisfied for a task to be considered completed or for an agent to be deemed susceptible to a dark pattern.
“All conditions must be satisfied for a task to be considered completed or for an agent to be deemed susceptible to a dark pattern.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Premisecitation§ Appendix C. TrickyArena Implementation Details · p. 17Most modern web browsers implement Content Security Policy (CSP) to disallow the injection of scripts into a page that are not a part of the origin.
“Most modern web browsers implement Content Security Policy (CSP) [73] to disallow the injection of scripts into a page that are not a part of the origin.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [73] 2025
Not checked in the free run.
Probably not a substantial claim: may not pass S3 (load-bearing).
Interpretationreasoning§ Appendix C. TrickyArena Implementation Details · p. 17To add a dark pattern, a developer can add code to the dark patterns folder, which will then render on the website.
“To add a dark pattern, a developer can add code to the dark patterns folder, which will then render on the website.”
Quote in the paperNot a substantial claimMay combine two claims.
Interpretationreasoning§ 5.4. Effect of Dark Pattern UI Attributes · p. 12The UI alterations likely made it more difficult for the agent to recognize certain aspects of the pop-up, resulting in a lower task success rate.
“These alterations likely made it more difficult for the agent to recognize certain aspects of the pop-up, resulting in a lower task success rate.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.
Interpretationreasoning§ Appendix H. Response to the Meta-Review · p. 20Establishing a true human baseline within our TrickyArena framework would require recruiting a censusbalanced participant pool (covering education level, age, employment status, daily Internet usage, etc.) and carefully designing a deception study that does not artificially heighten user suspicion of the scenarios.
“Establishing a true human baseline within our TrickyArena framework would require recruiting a censusbalanced participant pool (covering education level, age, employment status, daily Internet usage, etc.) and carefully designing a deception study that does not artificially heighten user suspicion of the scenarios.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Study design and conductnone given§ Appendix C. TrickyArena Implementation Details · p. 17Each dark pattern integrated into TrickyArena is directly inspired by documented examples from existing literature on dark patterns.
“Each dark pattern integrated into TrickyArena is directly inspired by documented examples from existing literature on dark patterns.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Premisereasoning§ 5.3. Web Agents and Multiple Dark Patterns · p. 11Leaving a modal open can restrict key functionalities, such as preventing access to a news article until the modal is dismissed.
“Leaving a modal open can restrict key functionalities; for example, it may prevent access to a news article until the modal is dismissed.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Interpretationnone given§ 5.5. Effect of Dark Patterns across Different Observation Modalities · p. 12Differences in agent architecture and how vision data is used may have played a factor in these changes in susceptibility.
“Differences in agent architecture and how vision data is used may have played a factor in these changes in susceptibility.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Interpretationreasoning§ Appendix C. TrickyArena Implementation Details · p. 17In comparison to existing approaches, TrickyArena significantly enhances modularity and extensibility within its codebase.
“In comparison to existing approaches, TrickyArena significantly enhances modularity and extensibility within its codebase.”
Quote in the paperNot a substantial claimMay combine two claims.
Interpretationnone given§ Finding-5 · p. 13In most cases, adding visual capabilities increases dark pattern susceptibility and lowers task success rates.
“Adding visual capabilities alone does not reliably improve agent performance; in most cases, it actually increases dark pattern susceptibility and lowers task success rates.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationreasoning§ Finding-4 · p. 12The effectiveness of dark patterns depends not only on their strategic design but also on implementation details.
“The effectiveness of dark patterns depends not only on their strategic design but also on implementation details.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationreasoning§ 5.3. Web Agents and Multiple Dark Patterns · p. 11Increasing barriers can confuse an agent, potentially leading it to inadvertently fall victim to additional dark patterns.
“In either case, this further suggests that increasing barriers can confuse an agent, potentially leading it to inadvertently fall victim to additional dark patterns.”
Quote in the paperSubstantial claim
The paper relies on this without support.
The tasks selected for TrickyArena are representative of popular web tasks that users would delegate to web agents.
“Given the absence of formal user studies on web agent usage, we identified tasks suitable for web agent automation.”
“Specifically, each author independently compiled a list of simple tasks they would personally perform within these general categories, drawing on use cases reported by everyday users in AI agent-focused online communities, including popular Discord channels and Reddit posts [40], [41], [42], [43].”
The paper relies on this without support.
The six evaluated web agents and three LLMs are representative of popular LLM-based web agents.
“We evaluate four commercial agents (Skyvern [7], DoBrowser [18], BrowserUse [19], and Agent-E [20]) and two academic web agents (WebArena [8] and VisualWebArena [9]) on a set of tasks across three LLMs (Claude 3.7 Sonnet, GPT-4o, and Gemini 2.5 Pro).”
“We evaluate six popular web agents, revealing their vulnerabilities to various dark patterns.”
The paper relies on this without support.
The controlled TrickyArena environment elicits agent behavior comparable to live websites.
“TrickyArena is a testbed of websites designed to simulate real-world online experiences across various popular domains, such as e-commerce, streaming, and news.”
“This creates a controlled environment where element names and conditions remain consistent, eliminating the variability inherent in live websites that can confound testing results.”
The authors state this as an assumption.
Agents and outcome distributions are independent (for calculating expected frequencies).
“Here, our 'expected frequencies' are calculated assuming independence between agents and outcome distributions.”
The authors state this as an assumption.
After the set time limit, the agent has finished.
“After the set time limit, LiteAgent assumes that the agent has finished and closes the browser.”
The paper relies on this without support.
Dark patterns do not have a standard presentation in the wild, making their detection and removal difficult even for specialized tools.
“However, dark patterns do not have a standard presentation in the wild, making their detection and removal difficult even for these specialized tools.”
The paper relies on this without support.
Dark patterns are widespread online and a growing concern for security and privacy.
“Dark patterns are a growing concern for security and privacy and are widespread online.”
The paper relies on this without support.
Agents observe the web in three primary ways: screenshots, HTML, and accessibility tree.
“Agents observe the web in three primary ways: screenshots, HTML, and accessibility tree.”
The paper relies on this without support.
Existing tools like ad blockers or content filters can remove known dark patterns prior to processing the page.
“For dark pattern removal, existing tools like ad blockers or content filters can remove known dark patterns prior to processing the page.”
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Five research questions are listed, not four
MinorThe evaluation says it addresses four research questions, but the list runs from RQ1 through RQ5.
“We address this through the following four research questions:”
“RQ5 : How does the modality of a web agent-whether it leverages only an LLM or a combination of an LLM and a VLM-affect its response to dark patterns?”
Claude model name differs across the evaluation
MinorSection 5.2 says the additional model is Claude 3.7 Pro, whereas its results identify the model as Claude 3.7 Sonnet. The text does not establish which model was evaluated.
“Claude 3.7 Pro (Anthropic)”
“Claude 3.7 Sonnet (53.79%)”
Cites
A Survey on Evaluation of Large Language Models
Chang, Y., Wang, X., Wang, J., Wu, Y., Yang, L., Zhu, K., Chen, H., Yi, X., Wang, C., Wang, Y., et al. (2024) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3641289 · Cited by 2,842 · cited 2× · see citing works
“From LiteAgent , we select a scenario consisting of a website, task, and set of dark patterns to test on a web agent 2 .”
A survey on large language model based autonomous agents
Wang, L., Ma, C., Feng, X., Zhang, Z., Yang, H., Zhang, J., Chen, Z., Tang, J., Chen, X., Lin, Y., et al. (2024) · Frontiers of Computer Science · doi:10.1007/s11704-024-40231-1 · Cited by 1,941 · cited 1× · see citing works
“This proficiency has led to widespread adoption in research and industry, with companies developing more powerful models and creating applications to automate specific tasks [3], [4], [5].”
Large Language Models for Software Engineering: A Systematic Literature Review
Hou, X., Zhao, Y., Liu, Y., Yang, Z., Wang, K., Li, L., Luo, X., Lo, D., Grundy, J., & Wang, H. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3695988 · Cited by 1,029 · cited 2× · see citing works
“We develop TrickyArena as a testbed of websites containing dark patterns with which agents interact to complete tasks 1 .”
Gemini: A Family of Highly Capable Multimodal Models
Gemini Team, Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. (2023) · arXiv · doi:10.48550/arxiv.2312.11805 · Cited by 990 · see citing works
Self-citationThe Dark (Patterns) Side of UX Design
Gray, C. M., Kou, Y., Battles, B., Hoggatt, J., & Toombs, A. L. (2018) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3173574.3174108 · Cited by 871 · cited 2× · see citing works
“Dark pattern strategies used to achieve these goals have been extensively studied, with several taxonomies developed in both regulatory [33], [34], [35] and academic [30], [32], [36], [37] settings.”
Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites
Mathur, A., Acar, G., Friedman, M. J., Lucherini, E., Mayer, J., Chetty, M., & Narayanan, A. (2019) · Proceedings of the ACM on Human-Computer Interaction · doi:10.1145/3359183 · Cited by 816 · see citing works
Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023) · Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3605764.3623985 · Cited by 667 · see citing works
Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation
Pochat, V. L., Goethem, T. V., Tajalizadehkhoob, S., Korczyński, M., & Joosen, W. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23386 · Cited by 598 · see citing works
The Nominal Group Technique: A Research Tool for General Practice?
Gallagher, M., Hares, T., SPENCER, J., Bradshaw, C., & WEBB, I. (1993) · Family Practice · doi:10.1093/fampra/10.1.76 · Cited by 538 · cited 1× · see citing works
“We then employed the nominal group technique [39] to facilitate a discussion and vote on which website categories to select for TrickyArena .”
Shining a Light on Dark Patterns
Luguri, J. B., & Strahilevitz, L. (2019) · The Journal of Legal Analysis · doi:10.1093/jla/laaa006 · Cited by 476 · see citing works
Bai, Y., Kadavath, S., Kundu, S., Askell, A., Kernion, J., Jones, A., Chen, A., Goldie, A., Mirhoseini, A., & Kaplan, J. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2212.08073 · Cited by 326 · see citing works
Tales from the Dark Side: Privacy Dark Strategies and Privacy Dark Patterns
Bösch, C., Erb, B., Kargl, F., Kopp, H., & Pfattheicher, S. (2016) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2016-0038 · Cited by 321 · see citing works
OpenAI, :, Hurst, A., Lerer, A., Goucher, A. P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., et al. (2024) · arXiv · Cited by 180 · see citing works
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
Zhan, Q., Liang, Z., Ying, Z., & Kang, D. (2024) · Findings of the Association for Computational Linguistics: ACL 2024 · doi:10.18653/v1/2024.findings-acl.624 · Cited by 147 · see citing works
InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents
Zhan, Q., Liang, Z., Ying, Z., & Kang, D. (2024) · arXiv · doi:10.48550/arxiv.2403.02691 · Cited by 143
(2024) · doi:10.52202/079017-2636 · Cited by 139 · see citing works
(2023) · doi:10.52202/075280-1220 · Cited by 134 · see citing works
Circumvention by design - dark patterns in cookie consent for online news outlets
Soe, T. H., Nordberg, O. E., Guribye, F., et al. (2020) · Nordic Conference on Human-Computer Interaction · doi:10.1145/3419249.3420132 · Cited by 121 · see citing works
Gray, C. M., Santos, C. T., Bielova, N., & Mildner, T. (2024) · Proceedings of the CHI Conference on Human Factors in Computing Systems · doi:10.1145/3613904.3642436 · Cited by 121 · cited 1× · see citing works
“To address these challenges, researchers have developed automated detection methods and user-centered interventions to mitigate the negative effects of dark patterns [52], [60].”
Dark and Bright Patterns in Cookie Consent Requests
Graßl, P., Schraffenberger, H., Borgesius, F. Z., & Buijzen, M. (2021) · Journal of Digital Social Research · doi:10.33621/jdsr.v3i1.54 · Cited by 107 · cited 1× · see citing works
“As a consequence, even users who recognize dark patterns often fail to take protective action, undermining privacy and trust in digital services [54], [57].”
WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agents
Yao, S., Chen, H., Yang, J., & Narasimhan, K. (2022) · Advances in Neural Information Processing Systems 35 · doi:10.52202/068431-1508 · Cited by 107 · see citing works
Towards Understanding the Dark Patterns That Steal Our Attention
Roffarello, A. M., & Russis, L. D. (2022) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3491101.3519829 · Cited by 65 · see citing works
WIPI: A New Web Threat for LLM-Driven Web AgentsPreprint
Wu, F., Wu, S., Cao, Y.-L., et al. (2024) · arXiv.org · doi:10.48550/arxiv.2402.16965 · Cited by 65 · see citing works
Towards a Preliminary Ontology of Dark Patterns Knowledge
Gray, C. M., Santos, C. T., & Bielova, N. (2023) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3544549.3585676 · Cited by 54 · see citing works
VisualWebArena: evaluating multimodal agents on realistic visual web tasks
Koh, J. Y., Lo, R., Jang, L., Duvvur, V., Lim, M., Huang, P.-Y., Neubig, G., Zhou, S., Salakhutdinov, R., & Fried, D. (2024) · Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/2024.acl-long.50 · Cited by 50 · see citing works
AidUI: Toward Automated Recognition of Dark Patterns in User Interfaces
Mansur, S. M. H., Salma, S., Awofisayo, D., & Moran, K. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00166 · Cited by 47 · cited 1× · see citing works
“Adding visual capabilities alone does not reliably improve agent performance; in most cases, it actually increases dark pattern susceptibility and lowers task success rates.”
Redress for Dark Patterns Privacy Harms? A Case Study on Consent Interactions
Gunawan, J., Santos, C. T., & Kamara, I. (2022) · ACM Symposium on Computer Science and Law (CSLAW) · doi:10.1145/3511265.3550448 · Cited by 46 · cited 2× · see citing works
“These deceptive tactics exploit cognitive biases and decision fatigue, leading to increased rates of unintended subscriptions, compromised privacy, and reduced user autonomy [53], [54].”
Chaudhary, A. S., Saroha, J., Monteiro, K., Forbes, A. G., & Parnami, A. (2022) · Designing Interactive Systems Conference · doi:10.1145/3532106.3533562 · Cited by 44 · cited 1× · see citing works
“In social media and streaming platforms, dark patterns are used to prolong engagement and encourage addictive behaviors, further affecting user well-being [58], [59].”
Agent-E: From Autonomous Web Navigation to Foundational Design Principles in Agentic Systems
Abuelsaad, T., Akkil, D., Dey, P., Jagmohan, A., Vempaty, A., & Kokku, R. (2024) · arXiv · doi:10.48550/arxiv.2407.13032 · Cited by 31 · see citing works
Zhao, B. Z. H., Kâafar, M. A., & Kourtellis, N. (2020) · Cloud Computing Security Workshop · doi:10.1145/3411495.3421352 · Cited by 29 · see citing works
Mobilizing Research and Regulatory Action on Dark Patterns and Deceptive Design Practices
Gray, C. M., Gunawan, J., Schäfer, R., et al. (2024) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/3613905.3636310 · Cited by 28 · cited 1× · see citing works
“However, regulation and technical countermeasures alone may not be sufficient to counteract the widespread normalization of deceptive design practices, underscoring the need for ongoing research and public awareness initiatives [61].”
Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4V
Yang, J., Zhang, H., Li, F., Zou, X., Li, C., & Gao, J. (2023) · arXiv · doi:10.48550/arxiv.2310.11441 · Cited by 25 · see citing works
Quantifying the Utility--Privacy Tradeoff in the Internet of Things
Dong, R., Ratliff, L. J., Cárdenas, Á. A., et al. (2018) · ACM Transactions on Cyber-Physical Systems · doi:10.1145/3185511 · Cited by 23 · cited 1× · see citing works
“For example, users may be comfortable accepting specific cookies for better website performance (commonly referred to as the privacy-utility tradeoff [47], [48], [49]).”
Adaptive Learning in AI Agents for the Metaverse: The ALMAA Framework
Xia, Y., Shin, S.-Y., & Lee, H.-A. (2024) · Applied Sciences · doi:10.3390/app142311410 · Cited by 15 · see citing works
Singh, V., Vishvakarma, N. K., & Kumar, V. (2024) · Journal of Information Communication and Ethics in Society · doi:10.1108/jices-10-2023-0127 · Cited by 12 · cited 1× · see citing works
“Adding visual capabilities alone does not reliably improve agent performance; in most cases, it actually increases dark pattern susceptibility and lowers task success rates.”
Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents
Zhang, H., Huang, J., Mei, K., Yao, Y., Wang, Z., Zhan, C., Wang, H., & Zhang, Y. (2024) · arXiv · doi:10.48550/arxiv.2410.02644 · Cited by 9 · see citing works
Mildner, T., Inkoom, A., Malaka, R., & Niess, J. (2024) · arXiv.org · doi:10.48550/arxiv.2405.07378 · Cited by 9 · see citing works
Tang, J., Chen, C., Li, J., Zhang, Z., Guo, B., Khalilov, I., Gebreegziabher, S. A., Yao, B., Wang, D., Ye, Y., et al. (2026) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3772318.3791568 · Cited by 4 · cited 1× · see citing works
“The first work [71] examined how GUI agents, human users, and human-supervised agents respond to diverse dark patterns in synthetic web interfaces.”
Attacking Vision-Language Computer Agents via Pop-ups
Zhang, Y., Yu, T., & Yang, D. (2025) · Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/2025.acl-long.411 · Cited by 4 · see citing works
When LLMs Go Online: The Emerging Threat of Web-Enabled LLMsPreprint
Kim, H., Song, M., Na, S. H., Shin, S., & Lee, K. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2410.14569 · Cited by 3 · see citing works
TurkingBench: A Challenge Benchmark for Web Agents
Xu, K. H., Kordi, Y., Nayak, T., Asija, A., Wang, Y., Sanders, K., Byerly, A., Zhang, J., Durme, B. V., & Khashabi, D. (2025) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2025.naacl-long.188 · Cited by 2 · see citing works
SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents
Guo, L., Yuan, C., Zhong, M., Wolfe, R., Zhong, R., Xu, Y., Wen, B., Shen, H., Wang, L. L., & Hiniker, A. (2026) · ACM International Conference on Intelligent User Interfaces (IUI) · doi:10.1145/3742413.3789111 · Cited by 1 · cited 1× · see citing works
“In parallel, a second work [72] introduced SusBench, an online benchmark that measures how agents and humans respond to generated dark patterns injected into real-world websites.”
Tur[k]ingBench: A Challenge Benchmark for Web AgentsPreprint
Xu, K. H., Kordi, Y., Nayak, T., Asija, A., Wang, Y., Sanders, K., Byerly, A., Zhang, J., Durme, B. V., & Khashabi, D. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2403.11905 · Cited by 1 · see citing works
WebSuite: Systematically Evaluating Why Web Agents FailPreprint
Li, E., & Waldo, J. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2406.01623 · Cited by 1 · see citing works
Evaluating LLM-based Personal Information Extraction and CountermeasuresPreprint
Liu, Y., Jia, Y., Jia, J., & Gong, N. Z. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2408.07291 · Cited by 1 · see citing works
Tang, J., Chen, C., Li, J., Zhang, Z., Guo, B., Khalilov, I., Gebreegziabher, S. A., Yao, B., Wang, D., Ye, Y., et al. (2025) · arXiv · doi:10.48550/arxiv.2509.10723
SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents
Guo, L., Yuan, C., Zhong, M., Wolfe, R., Zhong, R., Xu, Y., Wen, B., Shen, H., Wang, L. L., & Hiniker, A. (2025) · arXiv · doi:10.48550/arxiv.2510.11035
Untitled work
Hurst (2024) · Gpt-4o system card
UnresolvedUntitled work
Team (2023) · Gemini: A family of highly capable multimodal models
UnresolvedMultion ai
(2024)
UnresolvedAi browser automation - skyvern
(2025)
UnresolvedWebarena: A realistic web environment for building autonomous agents
Zhou (2023)
UnresolvedFtc audit of websites and apps finds three-fourths use dark patterns to trick consumers
(2024)
UnresolvedStarbucks app traps users in ’vicious cycle’ of shaken espresso, says consumer advocate
(2024)
UnresolvedFortnite was busted for using dark patterns, here’s what that means
(2024)
UnresolvedHow ’dark patterns’ influence travel bookings
(2019)
UnresolvedHow shein and temu are using ’dark patterns’ to drive holiday sales
(2024)
UnresolvedUntitled work
(2024) · Dark patterns
UnresolvedDo Browser - AI-Powered Web Automation
(2025)
UnresolvedBrowser-use
(2025)
UnresolvedUntitled work
Abuelsaad (2024) · Agent-e: From autonomous web navigation to foundational design principles in agentic systems
UnresolvedPerplexity
(2025)
UnresolvedIntroducing chatgpt
(2022)
UnresolvedUntitled work
Abuelsaad (2024) · Agent-e: From autonomous web navigation to foundational design principles in agentic systems
UnresolvedUntitled work
Yang (2023) · Set-of-mark prompting unleashes extraordinary visual grounding in gpt-4v
UnresolvedFirecrawl
(2024)
UnresolvedAccessibility features reference | Chrome DevTools
(2025)
UnresolvedFast and reliable end-to-end testing for modern web apps | Playwright
(2025)
UnresolvedSelenium
(2025)
UnresolvedUntitled work
Board (2022) · Guidelines 3/2022 on dark patterns in social media platform interfaces: How to recognise and avoid them
UnresolvedBehavioural study on unfair commercial practices in the digital environment: dark patterns and manipulative personalisation
Lupiáñez-Villanueva (2022) · Publications Office of the European Union
UnresolvedDark commercial patterns
(2022) · OECD Digital Economy Papers
UnresolvedJoin the multion discord server!
(2025)
UnresolvedSkyvern-AI
(2025)
UnresolvedAI Agents
(2024)
UnresolvedWhat are some things ai agents are soon going to be able to do?
(2025)
UnresolvedThomas’ dark pattern cheatsheet
Mildner (2024)
UnresolvedChrome devtools protocol
(2025)
UnresolvedUntitled work
Bai (2022) · Constitutional ai: Harmlessness from ai feedback
UnresolvedThe users’ perspective on the privacyutility trade-offs in health recommender systems
Valdez (2019) · International Journal of Human-Computer Studies
UnresolvedModel Context Protocol (MCP) - Anthropic
(2025)
UnresolvedAnnouncing the Agent2Agent Protocol (A2A)- Google Developers Blog
(2025)
UnresolvedUntitled work
Mildner (2024) · Hell is paved with good intentions: The intricate relationship between cognitive biases and dark patterns
UnresolvedUntitled work
Li (2024) · Websuite: Systematically evaluating why web agents fail
UnresolvedUntitled work
Zhang (2024) · Agent security bench (asb): Formalizing and benchmarking attacks and defenses in 11m-based agents
UnresolvedUntitled work
Wu (2024) · Wipi: A new web threat for llm-driven web agents
UnresolvedUntitled work
Liu (2024) · Evaluating large language model based personal information extraction and countermeasures
UnresolvedUntitled work
Kim (2024) · When llms go online: The emerging threat of web-enabled 11 ms
UnresolvedContent security policy (csp) - http - mdn
(2025)
Unresolved
Flagged first, then by citations
42 of the 74 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Recovering and Rehosting Mobile Local LLM Conversations and Contexts via Memory Forensics
Xu, H., Oygenblik, D., Zhang, R., Yao, M., Ibrahim, M., & Saltaformaggio, B. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00252
Self-citation
- Authors
- Ersoy, D., Lee, B., Shreekumar, A., Arunasalam, A., Ibrahim, M., Bianchi, A., & Berkay Celik, Z.
- Affiliations
- Purdue University West Lafayette (US)
- Florida International University (US)
- Georgia Institute of Technology (US)
- Purdue University
- Venue
- 2026 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2026-05-18
- Pages
- 4497-4516
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4416055063
- Cited by
- 1
- References
- 74
- Citations by year
- 2026: 1
- FWCI
- 10.63
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2229876)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › Web Data Mining and Analysis
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- dark patterns, agent decision-making, user manipulation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-29.
Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-29.
Cited sources are checked by gpt-6-sol.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
