Your Agent's Biggest Lie: "I Searched the Web"

When an agent says it checked the web, what establishes that it actually obtained usable information? Rafael Levi, introducing himself as representing Bright Data, starts with the gap between an agent’s confident account of its work and the access it really has. A request can encounter a CAPTCHA or another block before it reaches the data. Levi argues that a model’s tendency to satisfy the user can then hide the missing evidence behind a plausible answer.

The dangerous substitution is training knowledge presented as live information. Levi illustrates this with information from 2024 being offered as current in 2026; that is his example of stale knowledge, not a statement about every model’s cutoff. He estimates that Cloudflare makes roughly 20% of the web inaccessible to default AI fetching, but supplies no measurement establishing that access rate. Cloudflare’s crawl-policy announcement does not establish universal blocking across that share of the web.

There is also a failure mode in which a crawler receives content that is irrelevant to the intended source. Levi describes Cloudflare’s AI Labyrinth as feeding bots fake data. Cloudflare’s documented mechanism is more specific: an opt-in system introduces hidden links that lead suspected unauthorized crawlers into generated decoy pages. Those pages contain unrelated scientific facts, rather than deliberately false facts. Either way, obtaining text does not establish that the text answers the original request.

The resulting failure can be invisible: the request returns a CAPTCHA or an empty page, but the answer contains neither an error nor a warning. Levi describes fabricated numbers and citations that lead to nonexistent pages. He estimates that roughly 60% of ChatGPT citations do not work, without giving a sample or methodology. That is not an established general broken-link rate. His concrete example is a shopping request: the agent recommends a product for $50, but clicking the supplied link reveals neither a valid destination nor a product to buy. A plausible product, price, and citation are not evidence of a retrieved listing.

The demonstration switches to VS Code and compares two scripts with identical prompts: one without the Bright Data MCP server, and one with it. The tasks target Rightmove properties, Mistral’s LinkedIn company page, an Instagram account, an Amazon product, and TikTok. These are supplied destinations, selected because Levi expects their anti-bot systems to make access difficult.

The first run uses GPT-5 without browsing tools. It explicitly reports that it has no live web access. The tool-free baseline records zero successes and five failures across the selected URL tasks. This is a capability comparison, not a representative benchmark: Levi deliberately chose these sites, and the two runs have different tools despite receiving the same prompts. The baseline also admits its limitation, so this particular run does not demonstrate the concealed failure described in the opening.

Levi starts the second run with an MCP server exposing 69 tools. The first capability he describes is search: the agent can issue queries to Google, Bing, or DuckDuckGo rather than merely produce an answer that sounds like a search result. Next comes Markdown extraction, which returns page content without HTML tags so the model spends less context on markup. Batch search extends the query operation to multiple keywords; Levi illustrates it with 100 keywords. These are descriptions of the demonstrated tool surface: the current repository instead lists Google, Bing, and Yandex and documents batches of at most 10 items per call.

The remaining capabilities cover two different ways to obtain data: prebuilt APIs for supported sites and a remote browser that the agent can navigate. Levi describes browser infrastructure that solves CAPTCHAs automatically, assigns distinct fingerprints, and supports parallel sessions. He uses 100 simultaneous browsers as an illustration, not a measured concurrency result. The useful distinctions are:

These functions sit beneath the model’s reasoning: they determine what evidence the agent can obtain before it writes an answer.

As results arrive, Levi identifies successful retrieval for Rightmove, Mistral’s LinkedIn page, Instagram, and the Amazon product. He does not explicitly narrate a TikTok result at this point. He then asks the LLM to compare the two runs. That comparison is another output of the demonstration, rather than an independent check of the returned data.

An audience question makes the social-profile workflow more concrete: does the service operate accounts to retrieve those pages? Levi says it works only with publicly available data. He connects that policy to the terms accepted when creating an account and to litigation over scraping. This is the service boundary he describes, not a universal rule that authenticated collection is illegal or public collection is legally risk-free. Privacy authorities’ guidance on scraping explicitly applies privacy obligations to publicly accessible personal information.

When the audience questions how much LinkedIn or Instagram exposes publicly, Levi opens a LinkedIn URL in an incognito window and shows that some information is visible without signing in. The discussion then moves from company pages to people’s profiles. He attributes access differences to IP reputation and request patterns, including the shared network at an event. He suggests that a home connection might allow access to 5–10 profiles before prompting for login; this is an anecdotal, conditional estimate, not a reliable quota.

The follow-up question is whether users can supply credentials for their own social accounts. Levi’s answer remains no: the service described does not accept credentials to collect data behind login. An unauthenticated page view and an authenticated account workflow therefore belong on different sides of this integration’s stated boundary.

A question about caching introduces an alternative to live collection: query an existing dataset. Levi’s example is finding LinkedIn AI engineers in a particular area. If information that may be a few months old is acceptable, the agent can filter stored records and return the matching subset instead of visiting each profile again.

The answer describes a dataset product, not a cache invalidation policy or a promised refresh interval. The application still needs to decide how current its answer must be.

Returning to the terminal comparison, Levi reads failure and success labels for the two runs, with the baseline characterized as lacking live web access. The spoken readout does not clearly map every label to a site. He then explains the browser’s intended continuation behavior: when navigation encounters a CAPTCHA, the browser handles it internally so the agent can resume browsing. That removes an access interruption; it does not itself validate the information eventually returned.

Levi’s proposed remedy is to improve retrieval access through MCP so the agent has less reason to fill missing evidence with an unsupported answer. He returns to both blocked requests and misleading content, then introduces a free request allowance for trying the integration. The mechanism addresses an important prerequisite for grounded answers—obtaining source material—but successful access alone cannot establish factual correctness.

An audience member asks how the system detects AI Labyrinth. The answer is an avoidance strategy, rather than a demonstrated content detector: Levi describes prerecorded mouse movement and human-like typing intended to keep browser sessions from being classified as bots. No procedure is shown for recognizing a decoy page after it has been retrieved.

The difficulty becomes clearer in his hotel-price example. A phone may receive one price, a desktop another, and a proxy connection a third. Those differences do not establish which price is correct—or whether the cause is deception, personalization, location, or another access condition. Levi’s proposed response is to make the agent look human and, in his words, “hope for the best.” That qualification matters: the approach tries to avoid a problematic response, but does not prove the response’s validity.

Levi acknowledges that he has little statistical evidence about Labyrinth and describes it as having launched about a month earlier. Its announcement was actually March 19, 2025, more than a year before the April 2026 event. He reports no observed degradation while collecting petabytes of data daily and comparing cached results. The talk supplies no measurement protocol or independent validation for that observation, so it cannot establish immunity to misleading content.

The discussion then shifts from access to the cost of processing retrieved pages. Levi points to GitHub and Bright Data Agent Skills, describing instructions and API information that an agent can use to build a scraper or collection pipeline. He previews a later session in which an agent will build a Walmart collector. That pipeline is promised for the later session, not built in this recording.

The architectural change is to use the LLM to build a reusable parser, then run that parser in ordinary code. For a workload such as 10,000 pages, the model need not interpret every page’s HTML separately:

1. Have the agent develop the extraction logic for the target page structure.
2. Put that logic in a parser that a script can invoke.
3. Run the script over the collected pages.

Levi claims approximately 99% token savings for the proposed reusable-parser approach, without a measured baseline or test details. The useful principle does not depend on that percentage: repeated extraction moves out of model calls and into reusable code.

The next performance question concerns the 69-tool surface: must an application load every tool just to search? Levi says no. The broad list was there to demonstrate capability; for simple retrieval, he would expose only search and Markdown scraping. Tool definitions consume context, so irrelevant capabilities add material the model must process without helping the task.

An application can express that boundary as an allowlist over the tool definitions returned by its server. The TypeScript below illustrates the filtering operation; the caller supplies the actual search and Markdown tool names from its chosen server version:

type NamedTool = { name: string };

function selectRetrievalTools<T extends NamedTool>(
  availableTools: readonly T[],
  searchToolName: string,
  markdownToolName: string,
): T[] {
  const allowedNames = new Set([
    searchToolName,
    markdownToolName,
  ]);

  for (const name of allowedNames) {
    if (!availableTools.some((tool) => tool.name === name)) {
      throw new Error(`Required retrieval tool is unavailable: ${name}`);
    }
  }

  return availableTools.filter((tool) => allowedNames.has(tool.name));
}

Pass the returned definitions to the model instead of the full list. Filtering preserves the selected tools’ definitions while excluding unrelated ones; it does not change their underlying retrieval behavior.

The final technical question sharpens the interpretation of the experiment. Did it use OpenAI’s web-search tool, or only call Bright Data? Levi clarifies that the task was to load supplied URLs: no searches were performed. The completed terminal comparison visible at 14:36.740 labels Demo 1 as 0/5 succeeded and Demo 2 as 5/5 succeeded. Those are the displayed LLM-generated verdicts for this selected URL-loading demonstration, not independently verified retrieval scores.

Levi reiterates that no search tool was used, although Google search is available through the MCP server. That separates three capabilities that an agent’s answer can easily blur:

The comparison demonstrates the difference between no browsing tools and an enabled retrieval integration. It does not compare Bright Data with OpenAI’s web-search tool or establish which search backend an agent uses merely because the user expects Google-like results. Levi invites the audience to try the integration and compare results on their own tasks.

The closing question resolves the unit behind the free offer: is the allowance daily? Levi states that the free tier includes 5,000 requests per month. He also mentions pay-as-you-go without giving prices or detailed conditions. His adoption context is an MVP, a small experiment, or a hackathon: connect the agent to MCP and use that access while building the application. The recording ends with that invitation, rather than an installation walkthrough or a production deployment.