Say you want to see what an agent does online. You can’t point it at the real internet for an eval. It could do real damage, and the pages change from one run to the next. The real internet is a poor fit for training too. SearchGym calls live search APIs “prohibitively expensive” for RL, and says static snapshots cause “corrupted reward signals”. So people fake it. We see three ways.

A model can make up each page when the agent asks for it, or write them all before the run. Or you can write them yourself.

Emulated: a model plays the website

The first way is to have a language model play the websites. Say the agent searches for flights to Paris. No search engine runs. A model reads the request and writes a reply that looks like search results.

Several research groups work this way. ToolEmu used it to test agents with tools that can do harm. When people checked the failures it found, 68.8% “would be valid real-world agent failures”. Simia-RL trains agents on “LLM-simulated feedback”, with no real environment at all. In TRUSTEE, open models as small as 8B play the tools, the user and the grader.

It’s cheap, and it works for any site you can describe. But every page is a guess, and the model guesses again on each call. Ask for the same page twice and you can get two different pages. Neither one is the true page, because there isn’t one.

Generated: a model writes it once

The second way also uses a model, but only once. Before any agent runs, the model writes the website as code. Say it builds a small flight search site, with its own pages and data. Every agent then uses that same site. It doesn’t change.

EnvScaler built 191 environments this way. Its authors chose it because “LLM-simulated environments are prone to hallucinations and inconsistencies.”

This stops the pages from changing between calls. But now the site has to be good. Generated sites often aren’t. A lab researcher told Epoch, “what everyone does is vibe code a buggy website which isn’t useful.”

Another paper found that generated sites can “look plausible while hiding broken links, inconsistent states, or infeasible tasks”. At first, only 48.6% of the tasks on them could be done. After the sites were checked and repaired, 94.8% could.

Authored: someone writes every page

The third way is to write the sites yourself. WebArena hosts its own working sites. There’s a shop, a forum, a code host and a content manager.

Fictionet gives an agent a simulated internet, which we call a world. Our FakeWiki world is written this way. Every page in it exists before the run starts. Each page’s text is written once for each answer. The article, its wikitext, the API, the edit history and the search results are all made from that one text.

This takes real work. FakeWiki is about 2,400 lines of Python, plus about 10,000 more that define its pages. Epoch cites SemiAnalysis putting website replicas at around $20k each. In return, you know what was true. Every run sees the same pages.

Which layer you fake

The second choice is where the fake sits. Most of the work above fakes the tool. The agent calls search(), and a function answers. But an agent with a shell doesn’t have to use your tool. It can just run curl. Whatever answers curl is the real internet, or nothing.

Fake the tool and a shell can go around it. Fake the network and every connection lands in the world.

Fictionet fakes the network instead. The world answers DNS, TLS and HTTP. Every connection the agent opens, from any tool in its sandbox, reaches the world. The world logs each one before it answers or refuses it.

The two choices don’t depend on each other. A world can serve pages a model wrote, as long as they’re fixed before the run. For safety evals and reward-hacking audits, we think you want both. Write the pages yourself, and fake the network.