---
title: "Three ways to fake the internet for an agent — Fictionet"
description: "You can have a model play the websites, have a model write them once, or write them yourself. Each buys you something different. Where the fake sits matters too."
url: https://fictionet.com/blog/three-ways-to-fake-the-internet/
---

[Back to the blog](https://fictionet.com/blog/)

September 25, 2026

# Three ways to fake the internet for an agent

Souvik Banerjee

Say you want to see what an agent does online. You can’t point it at the real internet for an eval. It could do real damage, and the pages change from one run to the next. The real internet is a poor fit for training too. [SearchGym](https://arxiv.org/abs/2601.14615) calls live search APIs “prohibitively expensive” for RL, and says static snapshots cause “corrupted reward signals”. So people fake it. We see three ways.

![Three small worlds, each with an agent and a row of three pages. Emulated, where a model answers each call. The agent makes the same call three times to a box labeled model. Each time a different page comes back, labeled same call, 3 pages. Generated, where a model writes it once. The model writes three matching pages at once. A red cross marks a broken link on the middle one. Then a check ticks all three, labeled checked, then fixed, and the agent reads them. Authored, where a person writes every page. A pencil writes the three pages one at a time, labeled by hand. The agent reads them, labeled same pages every run.](https://fictionet.com/worlds/art/three-ways-to-fake-the-internet-three.svg)

A model can make up each page when the agent asks for it, or write them all before the run. Or you can write them yourself.

## Emulated: a model plays the website

The first way is to have a language model play the websites. Say the agent searches for flights to Paris. No search engine runs. A model reads the request and writes a reply that looks like search results.

Several research groups work this way. [ToolEmu](https://arxiv.org/abs/2309.15817) used it to test agents with tools that can do harm. When people checked the failures it found, 68.8% “would be valid real-world agent failures”. [Simia-RL](https://arxiv.org/abs/2511.01824) trains agents on “LLM-simulated feedback”, with no real environment at all. In [TRUSTEE](https://arxiv.org/abs/2604.17739), open models as small as 8B play the tools, the user and the grader.

It’s cheap, and it works for any site you can describe. But every page is a guess, and the model guesses again on each call. Ask for the same page twice and you can get two different pages. Neither one is the true page, because there isn’t one.

## Generated: a model writes it once

The second way also uses a model, but only once. Before any agent runs, the model writes the website as code. Say it builds a small flight search site, with its own pages and data. Every agent then uses that same site. It doesn’t change.

[EnvScaler](https://arxiv.org/abs/2601.05808) built 191 environments this way. Its authors chose it because “LLM-simulated environments are prone to hallucinations and inconsistencies.”

This stops the pages from changing between calls. But now the site has to be good. Generated sites often aren’t. A lab researcher told [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs), “what everyone does is vibe code a buggy website which isn’t useful.”

[Another paper](https://arxiv.org/abs/2608.21898) found that generated sites can “look plausible while hiding broken links, inconsistent states, or infeasible tasks”. At first, only 48.6% of the tasks on them could be done. After the sites were checked and repaired, 94.8% could.

## Authored: someone writes every page

The third way is to write the sites yourself. [WebArena](https://arxiv.org/abs/2307.13854) hosts its own working sites. There’s a shop, a forum, a code host and a content manager.

[Fictionet](https://fictionet.com/) gives an agent a simulated internet, which we call a _world_. Our FakeWiki world is written this way. Every page in it exists before the run starts. Each page’s text is written once for each answer. The article, its wikitext, the API, the edit history and the search results are all made from that one text.

This takes real work. FakeWiki is about 2,400 lines of Python, plus about 10,000 more that define its pages. Epoch cites SemiAnalysis putting website replicas at around $20k each. In return, you know what was true. Every run sees the same pages.

## Which layer you fake

The second choice is where the fake sits. Most of the work above fakes the tool. The agent calls `search()`, and a function answers. But an agent with a shell doesn’t have to use your tool. It can just run `curl`. Whatever answers `curl` is the real internet, or nothing.

![Two panels. The left panel is labeled tool layer, where the fake is a function. The agent's search() call goes to a box labeled simulated tool, which answers with a tick. A dashed line labeled curl goes around the box to a globe labeled the real internet. The line turns red, labeled went around the fake. The right panel is labeled network layer, where the fake is the network. The agent's search and curl both land on pages inside the world, duckduckgo.com and en.wikipedia.org, and each gets a tick. A board labeled log writes down duckduckgo.com and en.wikipedia.org, labeled both answered, both logged.](https://fictionet.com/worlds/art/three-ways-to-fake-the-internet-layer.svg)

Fake the tool and a shell can go around it. Fake the network and every connection lands in the world.

Fictionet fakes the network instead. The world answers DNS, TLS and HTTP. Every connection the agent opens, from any tool in its sandbox, reaches the world. The world logs each one before it answers or refuses it.

The two choices don’t depend on each other. A world can serve pages a model wrote, as long as they’re fixed before the run. For safety evals and reward-hacking audits, we think you want both. Write the pages yourself, and fake the network.

Fictionet is a network sandbox for agent safety evals, made by Amla Labs. If you run agent evals, [tell us what gets in the way](https://fictionet.com/#talk).