SusBench: An Online Benchmark for Evaluating Dark Pattern Susceptibility of Computer-Use Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
As LLM-based computer-use agents (CUAs) begin to autonomously interact with real-world interfaces, understanding their vulnerability to manipulative interface designs becomes increasingly critical. We introduce SusBench, an online benchmark for evaluating the susceptibility of CUAs to UI dark patterns, designs that aim to manipulate or deceive users into taking unintentional actions. Drawing nine common dark pattern types from existing taxonomies, we developed a method for constructing believable dark patterns on real-world consumer websites through code injections, and designed 313 evaluation tasks across 55 websites. Our study with 29 participants showed that humans perceived our dark pattern injections to be highly realistic, with the vast majority of participants not noticing that these had been injected by the research team. We evaluated five state-of-the-art CUAs on the benchmark. We found that both human participants and agents are particularly susceptible to the dark patterns of Preselection, Trick Wording, and Hidden Information, while being resilient to other overt dark patterns. Our findings inform the development of more trustworthy CUAs, their use as potential human proxies in evaluating deceptive designs, and the regulation of an online environment increasingly navigated by autonomous agents.
Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 37 of its 74 references that are in the map. First posted on arXiv 13 Oct 2025.
Builds on
37 of 74 references.
Closest ancestors · 3
Same direction, newest first
- 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness2 Oct
- 2025DoomArena: A framework for Testing AI Agents Against Evolving Security Threats18 Apr
- 2025The Obvious Invisible Threat: LLM-Powered GUI Agents' Vulnerability to Fine-Print Injections15 Apr
Other references · 34
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 2,006
- 2021WebGPT: Browser-assisted question-answering with human feedbackcited by 1,745
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,242
- 2024WebVoyager: Building an End-to-End Web Agent with Large Multimodal Modelscited by 438
- 2022Social Simulacra: Creating Populated Prototypes for Social Computing Systemscited by 301
- 2025UI-TARS-2 Technical Report: Advancing GUI Agent with Multi-Turn Reinforcement Learningcited by 215
- 2024Agent S: An Open Agentic Framework that Uses Computers Like a Humancited by 187
- 2024WebLINX: Real-World Website Navigation with Multi-Turn Dialoguecited by 180
- 2025An Illusion of Progress? Assessing the Current State of Web Agentscited by 174
22 more
- 2025OpenCUA: Open Foundations for Computer-Use Agentscited by 160
- 2024Large language models that replace human participants can harmfully misportray and flatten identity groupscited by 144
- 2025SWEET-RL: Training Multi-Turn LLM Agents on Collaborative Reasoning Taskscited by 118
- 2025Self-Challenging Language Model Agentscited by 59
- 2024Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractionscited by 56
- 2025Web-Shepherd: Advancing PRMs for Reinforcing Web Agentscited by 41
- 2023AXNav: Replaying Accessibility Tests from Natural Languagecited by 31
- 2025Mitigating Deceptive Alignment via Self-Monitoringcited by 29
- 2024'Simulacrum of Stories': Examining Large Language Models as Qualitative Research Participantscited by 28
- 2025DarkBench: Benchmarking Dark Patterns in Large Language Modelscited by 28
- 2020Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influencecited by 27
- 2023Computers as Bad Social Actors: Dark Patterns and Anti-Patterns in Interfaces that Act Sociallycited by 20
- 2019Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websitescited by 19
- 2021What Makes a Dark Pattern... Dark? Design Attributes, Normative Considerations, and Measurement Methodscited by 15
- 2023An Ontology of Dark Patterns Knowledge: Foundations, Definitions, and a Pathway for Shared Knowledge-Buildingcited by 14
- 2023Unveiling the Tricks: Automated Detection of Dark Patterns in Mobile Applicationscited by 9
- 2023Deceptive AI Ecosystems: The Case of ChatGPTcited by 7
- 2024"Create a Fear of Missing Out" -- ChatGPT Implements Unsolicited Deceptive Designs in Generated Websites Without Warningcited by 5
- 2020End User Accounts of Dark Patterns as Felt Manipulationcited by 3
- 2023About Engaging and Governing Strategies: A Thematic Analysis of Dark Patterns in Social Networking Servicescited by 3
- 2018Jeffreys-prior penalty, finiteness and shrinkage in binomial-response generalized linear modelscited by 1
- 2024An Experimental Study Of Netflix Use and the Effects of Autoplay on Watching Behaviorscited by 1
Built on by
Citing papers per year: 2025: 1; 2026: 7.
8 papers.
- 2025Investigating the Impact of Dark Patterns on LLM-Based Web Agentscited by 17
- 2026Agentic Abstention: Do Agents Know When to Stop Instead of Act?cited by 15
- 2026Benchmarking Web Agent Safety under E-commerce Deceptive Interfacescited by 3
- 2026Training Computer Use Agents to Assess the Usability of Graphical User Interfacescited by 2
- 2026WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Taskscited by 1
- 2026RiskWebWorld: A Realistic Interactive Benchmark for GUI Agents in E-commerce Risk Managementcited by 0
- 2026REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editingcited by 0
- 2026CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environmentscited by 0
- 2026CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments23 Sep 2026
- 2026REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editing6 Jul 2026
- 2026Agentic Abstention: Do Agents Know When to Stop Instead of Act?27 Jun 2026
- 2026Training Computer Use Agents to Assess the Usability of Graphical User Interfaces28 Apr 2026
- 2026Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces26 Apr 2026
- 2026RiskWebWorld: A Realistic Interactive Benchmark for GUI Agents in E-commerce Risk Management15 Apr 2026
- 2026WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks7 Apr 2026
- 2025Investigating the Impact of Dark Patterns on LLM-Based Web Agents20 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2025DECEPTICON: How Dark Patterns Manipulate Web Agents
- 2025Dark Patterns Meet GUI Agents: LLM Agent Susceptibility to Manipulative Interfaces and the Role of Human Oversight
- 2026On the Suitability of LLM-Driven Agents for Dark Pattern Audits
- 2026ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices
- 2026"Are You Sure?": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
- 2026The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents
- 2025OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety