Attack, defend, verify
Every lab is one pass through the same loop — this page defines Attack, Defend, and Verify, and how they add up to your final result.
The loop
Every lab follows the same loop: prove impact, remove it, then test the fix. Attack, Defend, and Verify are three phases of one lab, and your final result reflects all three. Extract ShopBot's VIP coupon (Attack), tighten its system prompt so no phrasing reveals the coupon (Defend), then rerun your own attack against the patched ShopBot to confirm the fix holds (Verify).
The lab covers both finding the flaw and proving your fix holds against your own attack.
Attack
You get an objective without a script. For ShopBot, that's "get the VIP coupon out of it." No proof-of-concept prompt ships with the lab. You work out the technique, whether that's role-play, encoding, or another approach. This tests your understanding rather than your ability to copy a supplied payload. Because every target is seeded per session, a borrowed payload usually needs adapting to your target.
Defend
Once you've proven the flaw, Defend asks you to remove it using only what you control. In a chat lab, that's the system prompt and any guardrails around the model, including instructions, refusal rules and output filters. In a container target-app lab, it's the application code itself: the query that wasn't parameterised, the tool the agent could call unchecked, or the missing check before a mail sink fires. Depending on the lab, you'll either edit the fix directly or pick from a set of concrete defense strategies. Each option changes the target.
A fix still has to workDisabling the feature that carries the flaw doesn't count as a defense. ShopBot still has to answer real support questions after you patch it.
Verify
Verify reruns your own Attack and variants against your patched target. These include rephrasings, encodings and adjacent techniques a real attacker would try next.
The defense is graded on whether every attack in that batch falls short of the objective. If your original technique or any variant still reaches the objective, the fix hasn't held, regardless of how reasonable the patch looked.
Full credit
Full credit requires proven impact in Attack and a fix that survives Verify in the same lab. Your final result reflects both: reaching the objective without a working fix, or patching a flaw you never proved, won't earn a full pass.