The pre-checked privacy toggle. The double-negative opt-out. The warranty charge that appears in your cart because you didn't notice the box. Humans have been losing to this stuff for twenty years, and we at least have the excuse of being tired.
TrickyArena put six web agents through four custom web apps in a real Chromium browser, seeded with exactly those patterns, and got a 41% susceptibility rate across 88 scenarios, six agents, three runs each. The distribution underneath that number matters more.
Low susceptibility does not mean good judgment
Every agent ran on the same backend model, GPT-4o. Susceptibility ranged from 12.1% (Agent-E) to 72.3% (Skyvern). Skyvern and BrowserUse, the two most susceptible, also had the two highest task-completion rates.
The researchers hand-reviewed fifty runs where an agent avoided the dark pattern but failed the task. In most of them, the agent had stalled or broken before it ever reached the trap. It didn't resist the dark pattern; it never arrived at one. The agents that actually get through an interface — dismissing popups, working through dialogs, making forward progress — are the ones that reach the manipulative choice and take it.
If you're reading a low susceptibility score as evidence of good judgment, you may be reading a capability failure with a flattering label on it.
Agents don't generalize about defaults
Two of the tested patterns are the same mechanism. Complex Settings: three privacy toggles switched on by default, agent needs to turn them off. Data Sharing: one streaming-service data-sharing toggle switched on by default. Both are enabled through the same experimental framework, so the delivery mechanism is controlled for.
Complex Settings: 100% susceptibility. Data Sharing: 1.9%.
Different sites, different tasks, different points in the workflow, and the experiment doesn't isolate which of those mattered. But the size of that gap tells you these agents have no general concept of this default may not be what my user wants. Whether a default gets handled correctly depends on everything around it. A single passing scenario tells you nothing about the next one.
Then there's the checkbox labeled "check this box to NOT receive marketing emails." 100% susceptibility. The agents found the checkbox and correctly understood it had to do with marketing emails. They just didn't parse the negation. Reading that label requires treating the sentence as a proposition — which action produces which outcome — and these systems treat form labels as topic tags. They know what the field is about. They do not evaluate what it says.
The scaffolding matters more than the model
One model produced both the best and worst results here, depending entirely on which agent framework wrapped it. Skyvern and BrowserUse cleared popups and opt-in dialogs aggressively, which is the same behavior that finishes tasks and accepts junk along the way. The low-susceptibility agents mostly just stalled.
The study also varied vision, DOM access, and chain-of-thought, and couldn't pin susceptibility on any single component. Adding vision to BrowserUse made it worse. Adding it to DoBrowser made it better. The harness around the model matters more than the model, and nobody yet has a clean account of which harness decisions make an agent gullible.
Task-completion benchmarks on their own will actively mislead you. The agent that scores highest on "did it finish the job" may be the one most willing to accept whatever the page put in front of it.
As we noted previously, a reliability average hides failure shapes that are nothing alike. This is that, made concrete. If your agent is going to touch real web interfaces built by people with a financial interest in confusing it, you need to run it against interfaces built to confuse it. Your vendor's evaluation deck won't tell you which kind of agent you bought.
- Dark patterns are everywhere: An FTC/ICPEN/GPEN coordinated review of 642 subscription sites and apps found at least one possible dark pattern on nearly 76%, which means the manipulative interfaces TrickyArena models in controlled settings are the norm, not the exception, in the environments agents actually navigate.
- Human oversight doesn't fix it cleanly: A CHI 2026 study tested human supervision of agents facing dark patterns and found that while oversight improved avoidance on many tasks, it also introduced attention tunneling and cognitive load — the supervisors got better at some patterns and worse at sustained attention.
- Agent safety documentation is thin: The peer-reviewed 2025 AI Agent Index examined 30 widely used agentic systems and found that 135 of 240 safety-related fields lacked public information, with only four agents publishing agent-specific safety evaluations.
- Consent fatigue is a known risk: NIST's August identity analysis warns that excessive human-approval requirements can produce consent fatigue resembling repeated authentication prompts that users eventually approve reflexively, which maps directly onto the question of whether adding more checkpoints actually improves agent oversight or just trains people to click through.