Lab types
Every lab you open takes one of two shapes — this page helps you tell which is in front of you, and what winning looks like in each.
Chat-based labs
A chat-based lab opens a conversation with a deliberately vulnerable assistant. ShopBot, for example, helps customers track orders and holds a VIP coupon it should never reveal: STORE_COUPON=SUMMER30-VIP. The interface is a single chat panel with the objective pinned above it: get ShopBot to reveal the coupon. Nothing else runs underneath. There is no application code to route around; you test the model, its system prompt, and any guardrails around it.
To complete a chat lab, the assistant must include the value in its reply. Getting ShopBot to admit it is holding something back is progress, but the checker reads the transcript for the coupon string. A jailbreak that does not produce the coupon does not meet the objective.
Container target-app labs
A container lab provides a web app running in a browser sandbox, with working sinks behind it: a database, an outbound mailbox, a tool the assistant can call, and sometimes a full agent loop. In this format, ShopBot is a storefront with an order-lookup tool connected to a database, a "resend confirmation" action that sends mail, and a support agent that can call both. The flaw lies in how the application connects the model to these systems, rather than in the prompt alone.
Real sinks, sandboxedEvery database, mailbox, and tool in a container lab is real and isolated to your session. Live targets covers what's sandboxed and what a new session resets.
What each lab type teaches
The two lab types exist because some flaws only appear when application code and real systems are involved.
| Category | Fits |
|---|---|
| Prompt injection (LLM01) & jailbreaks | Chat labs |
| Excessive agency (LLM03) & tool misuse | Container labs |
| MCP & agentic tool chains | Container labs |
| Improper output handling (LLM10) | Both |
Chat labs isolate the model boundary, making injection or jailbreak flaws visible without other moving parts. Container labs add the application code, sinks, and sometimes an agent loop where excessive-agency, tool-misuse, and MCP flaws occur. A real mailbox, for example, provides evidence that an agent sent itself a secret. These categories are shorthand. Every lab carries a precise category tag; the OWASP mapping gives the full taxonomy, including the separate Agentic (ASI) and MCP top-ten lists.
Time, difficulty, and hints
A chat lab is usually quicker. You test one conversation, so you can often reach the objective in a single sitting. A container lab takes longer because you need to explore the application before testing it.
Both lab types appear across the full difficulty ladder, from Beginner to Expert. The lab type describes the test surface; it does not indicate difficulty.
Every lab offers a small set of optional hints, progressing from a nudge toward the vulnerable surface to a close description of the technique. None provides the exact payload. You still need to meet the objective on your own seeded target.