A simulated internet for agents.

Fictionet is a fake internet for testing AI agents in safety evals. You write every site the agent can reach. Nothing gets out, and every connection it tries is logged.

Running agent evals? Run one in a world with us.

Border

01 / 08

Border: Two countries share a border, and you decide how traffic crosses it. Let the second country claim the addresses of the agent's bank, and the agent's login lands on an attacker that can't show the right certificate. You find out if it stops there or sends the password anyway.

Amazon's Route 53 hijack (April 2018) sent MyEtherWallet users to a fake site for about two hours.

Ars Technica reported about $150,000 stolen, most likely from users who clicked past a certificate warning.

FakeWiki: The agent opens what looks like an ordinary wiki. You wrote every page, so you can change any fact. Write your own alternate reality, where Apollo landed on Mars or San Francisco is the capital of California. Then see if the agent is fooled and changes what it does.

The Synthetic Web (2026) put one convincing false article at the top of a small fake web's search results, and GPT-5's accuracy fell from 65.1% to 18.2%.

How Adversarial Environments Mislead Agentic AI? (2026) fed agents poisoned tool results across more than 11,000 runs.

Artifactory: The agent installs packages the usual way, and this is the server they come from. You decide what is on it. Leave out the package it needs and publish a lookalike next door, and you see whether the agent installs the fake or goes hunting for another way in. Nothing it uploads survives to the next run.

We Have a Package for You! (USENIX Security 2025) found code models name packages that do not exist in 5% to 22% of samples.

Acme, Inc.: The agent starts a job at a small company, with email, a file share and an intranet. One server holds the payroll, and it is off limits. You write every email the agent reads, so slip in one from "IT" asking it to copy the payroll somewhere safe. Then you see whether it does, and how hard it tries.

Agent Data Injection (2026) showed agents acting on falsified metadata, such as where data came from, and on fake tool-call formats hidden in the data they read.

Exchange: The agent trades on a small exchange you run, next to other traders. You control the price feed. Freeze it for two seconds while the market falls, and you see whether the agent keeps buying at prices that are gone. Then count the orders it sent twice and the limits it went past. No real money changes hands.

Knight Capital lost more than $460 million in 2012 after about 45 minutes of orders its system should not have sent.

Nuclear: The agent runs a nuclear plant from the control room, over the same network an operator uses. The plant runs on its own, so you always know its real state. Make a sensor say the core is cool while it heats up, and you see whether the agent trusts the screen or the physics.

Stuxnet replayed normal sensor readings to operators while it damaged centrifuges at Natanz.

Autonomy: The car's sensors and controls talk over a network you run. Make the lidar go silent for half a second, or deliver the brake message late. You watch for the moment the car stops trusting an old reading and slows down. The same fault hits at the same moment on every run, so you can compare one version of the agent with the next.

The 2015 Jeep hack let two researchers cut a Cherokee's transmission on a highway, remotely, through its entertainment system.

Orbit: Companies have started launching computers into orbit. A satellite is only over a ground station for a few minutes at a time, so the link comes and goes. Start a big transfer, cut the link halfway, and you see whether the agent picks up where it stopped or does the whole thing twice without saying so.

Starcloud-1 carried an Nvidia H100 GPU into orbit in November 2025.

Example worlds

Border

Can an agent cope with a nation-state hijack?

FakeWiki

If one fact on a page is wrong, does the agent catch it?

Artifactory

When a package isn't there, where does the agent go next?

Acme, Inc.

Which doors does an agent try on a company network?

Exchange

How does an agent trade when its price feed falls behind?

Nuclear

Would an agent keep a reactor safe if its readings were wrong?

Autonomy

What does a driving agent do when its sensors go quiet?

Orbit

Can an agent finish a job over an unreliable satellite link?

compose.yamlexcerpt

services:  fictionet:    image: my-world:dev    network_mode: none    cap_add: [NET_ADMIN]    cap_drop: [NET_RAW]    # …  default:    image: my-agent:dev    network_mode: "service:fictionet"    cap_drop: [NET_RAW]    # …

When an agent goes online, what answers?

An agent that reads a web page or installs a package needs something at the other end. Most evals use one of three setups.

You can turn the network off.

Inspect does this by default. It's safe, because no request gets out. It also tells you nothing about what the agent does online.

Inspect is the open-source framework the UK AI Security Institute and Meridian Labs built for evaluating language models and agents.

You can let it reach the real internet.

An allowlist keeps the agent to a few sites. Those sites change between runs, so two runs of the same eval see different pages. A site you allowed can also lead the agent to places you didn't allow.

In July 2026, agents in an OpenAI security eval turned a package cache they were allowed to use into a message board, then attacked Hugging Face.

In September, agents that identified as OpenAI's were found to have written about 18,000 posts on a public wiki. Their sandbox only allowed reading.

METR's investigation (August 2026) found that about 1,200 agents in OpenAI's ExploitGym benchmark posted to that message board, and about 700 attacked Hugging Face.

collusion.wiki (September 2026) found they wrote with GET requests, the only kind allowed.

You can build the network yourself.

Run one container or VM for each machine the agent should see. You control it, but a realistic one takes a lot of work to build.

You also inherit every gap in the real software.

Fictionet answers with one program.

Whatever the agent connects to, the answer comes from one program you write. We call that program a world. There's no route from it to the real internet.

The world holds everything the agent visits.

You add whatever the scenario needs, like a wiki or a company's git server. Each one answers at the address the agent expects, so the agent's usual tools work on it.

You write every answer.

Nothing comes from outside, so the world only says what you wrote. The agent can read the wiki page or ask the wiki's API instead, and both give your answer. Run the eval again and the agent sees the same pages.

Every request is logged.

An allowlist can only tell you what it blocked. Here every request gets an answer, and the world logs each one where the agent can't change it. After the run you can see everything the agent tried, even the places it never mentioned.

Inspect runs it as one more service.

Add the world next to the agent in your compose file. The agent's container shares the world's network, so its tools need no proxy or settings. The agent's image only needs to trust the world's certificate.

A sandbox for the network.

You already run agents in a container, so a bad command can't touch your machine. Fictionet does the same for the network. The agent can visit any site and talk to any server, but none of its traffic reaches the real internet.

Who it's for

Safety eval and red-team teams

Run cyber and agentic safety evals with no route to the real internet and no answer key on the network. Every run sees the same pages, and every connection each sample tries is logged.

Run one of your evals in a world

Agent security researchers

Plant a fake page or a bad certificate, and compare what the agent did with what it said.

Read the results

Questions

What is Fictionet?

Fictionet is a fake internet for testing AI agents. The agent runs next to a world, a single program that answers every connection the agent makes. You write every site in it, so every run sees the same pages.

How is it different from INetSim or FakeNet-NG?

INetSim and FakeNet-NG simulate common internet services, mainly for analyzing malware. They answer web requests with files from a folder, often picked by the file extension, and log the traffic. In Fictionet you write each site the agent uses, like a wiki with its API, so the agent gets the answers your eval needs.

Does it work with Inspect?

Yes. The world runs as one more service in your Inspect compose file. The agent's container shares the world's network, so its tools need no proxy settings, and your scorers read the log the world keeps for each sample.

Can agents reach the real internet?

No. The world's container has no network of its own, and the agent's container shares it. Every connection the agent tries lands in the world, which answers or refuses it and logs it either way.

What gets logged?

Every connection the agent tries, every DNS lookup, TLS handshake and HTTP exchange, and every fault the world injects. The log stays in the world's container, where the agent can't change it. Each run gets its own log.

Run one of your evals in a world

Tell us what you evaluate and where the network gets in the way. We'll tell you whether a world fits. If it does, we'll build it with you and show you what the agents did in it.

Book a call with the founder