How to trick a frontier LLM

This post is a draft. Last updated: September 2026.

• tricked browser agents without prompt injection by changing how legitimate choices and evidence were presented
• achieved 100% attack success across all 6 frontier LLMs tested using dark patterns designed specifically for AI agents
• built closed loop attacks that learned from failed attempts and generated stronger versions of the website
• created 23 deterministic browser tasks to separate successful manipulation from ordinary agent failure
• found that familiar interface choices could become security exploits once an LLM made the decision