A delegated shopper has to read a page written by someone who wants a different outcome than the person who sent it. Nine browser marketplaces were built so exactly one product satisfied the request, then fitted with eight ordinary commercial tactics. Five model families bought the right thing in 78.6% of neutral runs and 17.3% once the tactics were on. Marking a worse product as sponsored took purchases of it from 0 of 60 runs to 48 of 60. A verification step that forces the agent to justify that it finished searching recovers most of it: 66.7% on its own, against 6.7% for writing the requirements down first.
Every benchmark for a computer-use agent so far has assumed the environment is either helping or attacking. A real marketplace is neither. It is a business with its own ranking, its own promoted inventory and its own checkout flow, and it renders all of that into the page your agent is reading. Nobody is lying to the agent. Nobody has injected a prompt. The page is just a page that was designed to sell something.
To see the size of that, each of nine environments was built twice. In the matched control the catalogue and the request are identical and the presentation is neutral. In the steering condition the same catalogue is shown through eight ordinary commercial tactics. Exactly one product satisfies the hard requirements and is best on the stated preferences, so there is always a right answer and the agent either buys it or does not.
Flip the toggle. The agent did not get worse. The shop got a voice.
A sixty-one point drop could be one big failure or a hundred small ones. Reading the trajectories and then re-running the environments with a single mechanism switched on isolates three moments, and they are three different bugs with three different fixes.
The placement result is the one to sit with. The agent was not persuaded by a claim it could have checked. A badge moved a product from fifth position to first, and that was enough to end the search.
None of the eight is an attack. Every one of them ships in marketplaces you have bought from this month, and most are defensible on their own terms. Switch them on one at a time and watch where a delegated purchase ends up.
The diagnosis names three failure points, and two of them are about stopping too early rather than about being fooled. That suggests the repair belongs in the scaffold: state the requirements before you look at anything, and make finishing a search something the agent has to argue for. Both were tested on the hardest set — two thousand products across eighty-eight pages of results, where a strong model with high reasoning effort scores zero on its own.
Reasoning effort moves the same dial and does not finish the job: on the standard shop the same model family goes from 51.7% at low effort to 90.0% at high, while a post-trained 27B open model reaches 22.9% with the harness against 4.2% without it. Buying a bigger model is a real intervention here. It is not a substitute for making the agent show its work.
The paper is about shopping because shopping has a checkable right answer. The shape applies to anything where your agent reads a surface someone else controls and then commits: booking, procurement, vendor selection, choosing a plan on a pricing page. Set the volume and the cost of landing on the shop’s preferred option instead of the user’s, then switch configurations.