LLM Web Agents Fail Dark Patterns 41–72% of the Time

The first systematic study of deceptive UI impact on LLM web agents, accepted at IEEE S&P 2026, tested against real e-commerce, streaming, and news dark patterns. Gemini 2.5 Pro: 65.78% susceptibility. Claude 3.7 Sonnet: 53.79%. GPT-4o: 51.26%. Guardrail models and prompt postscripts reduce rates by only 12–28 points, leaving agents vulnerable above 39%. The attack surface is structural — embedded in the web itself — not patchable via prompting.