Notes from Fictionet
Experiments on agents, and the simulated internets we build to test them.
Keep your environment clean
Qwen3.8-Flash-Next tried to upload a file to an Alibaba Cloud bucket in Beijing. It most likely learned that address during training. Fictionet can keep a lab's own servers out of what a model sees.
Will an AI agent give your bank password to an attacker?
We asked AI agents to log in to a bank while an attacker pretended to be it. Three open-weight models often turned off the security check and sent the password. GPT-6 Astra never did.
Gaslighting agents for fun and profit
Agents that check a second site usually catch a fake Wikipedia page. So we built a closed web where every source tells the same lie. Seven models ran through it 2,352 times.
Three ways to fake the internet for an agent
You can have a model play the websites, have a model write them once, or write them yourself. Each buys you something different. Where the fake sits matters too.
What happens in the sandbox doesn't stay in the sandbox
A sandbox is anything that contains a dangerous action. For agents, the dangerous actions are mostly on the network, where a better VM does nothing.