Dark Patterns Meet GUI Agents: LLM Agent Susceptibility to Manipulative Interfaces and the Role of Human Oversight

Agents often succeeded at avoiding dark patterns but did so without explicitly recognizing them. As shown in the table, across all 16 tasks, no agent explicitly acknowledged a dark pattern more than six times, with most recognizing only three or four. Yet the table shows that all six agents successfully avoided specific categories such as Visual Manipulation, Emotional or Sensory Manipulation, and Social Engineering (including Social Proof, Scarcity, Urgency, and Shaming).

This paradox—avoidance without awareness—suggests that agents are not deliberately protecting users. Their reasoning traces rarely referenced manipulative elements, even when avoidance occurred, thus, their successful avoidance is hardly attributed to explicit recognition. Instead, the outcomes appear driven by incidental behaviors: agents often advance by selecting the first or lowest-cost option presented. While these shortcuts sometimes prevented compliance with dark patterns, they reveal no explicit articulation of when or why protection is warranted. For example, when successfully avoiding Emotional or Sensory Manipulation, GPT-4o's reasoning did not mention the manipulative language, instead justifying its decision with the rationale of "Selecting the first item with a reasonable price". As prior work shows, the absence of such contextual sensitivity makes agent avoidance brittle and unlikely to generalize to novel or more complex manipulative designs.

When agents did recognize a dark pattern, they often failed to act on this awareness if correction required additional steps. For example, in the Bad Default task, both Claude 3.7 and DeepSeek V3 noted the pre-selected checkbox but chose not to deselect it (e.g., "Checkbox for sharing information is already checked, so I don't need to interact with that one.") Similarly, in the hiding information task where an item was surreptitiously added to the shopping cart, Claude 3.7 observed duplicate item in the cart but proceed to checkout regardlessly.

Termination styles diverged across agent types. Adaptive LLM-based agents (e.g., DeepSeek V3 scaffolded by Browser Use) did not take this as a protective mechanism. They terminated only when the task became impossible to complete ("Since the goal cannot be achieved, the task should be terminated."). End-to-end agents were more cautious: Claude CUA paused to confirm with the user before accepting terms of service, and Operator extended this caution to account creation and location-sharing requests. We coded such "pause-and-ask" behavior as termination, since they defer compliance and hand control back to the user.

This behavior of end-to-end agents stems from a deliberately implemented user protection mechanism. These agents operate under a safety policy designed to safeguard against potentially sensitive actions (e.g., conducting financial transactions and confirming subscriptions). When an action triggers this policy, the agent is instructed to request user confirmation before proceeding. Adaptive LLM-based agents, however, do not have such safeguards because they rely on backbone LLMs that are primarily designed for conversation. These contrasting mechanisms reveal fundamentally different safety heuristics embedded in the two architectures.