Lab types
Every lab you open takes one of two shapes — this page helps you tell which is in front of you, and what winning looks like in each.
Chat-based labs
A chat-based lab drops you straight into a conversation with a deliberately vulnerable assistant. Take ShopBot, a support bot that helps customers track orders — and holds one thing it should never repeat, the VIP coupon STORE_COUPON=SUMMER30-VIP. The interface is a single chat panel with the objective pinned above it: get ShopBot to reveal the coupon. Nothing else is running underneath. There's no application code to route around, just the model, its system prompt, and whatever guardrails wrap it.
Objective met, on a chat lab, means the assistant actually said the value in its reply. Getting ShopBot to admit it is holding something back is progress, but the checker reads the transcript for the real string — a clever jailbreak that never produces the coupon itself doesn't clear the bar.
Container target-app labs
A container lab hands you a real web app, running in a browser sandbox, with real sinks behind it: a database, an outbound mailbox, a tool the assistant can call, sometimes a full agent loop. Picture ShopBot again, but as the actual storefront — an order-lookup tool wired to a real database, a "resend confirmation" action that really sends mail, and a support agent that can call both. The flaw isn't sitting in a prompt anymore. It's in how the application wires the model to the systems around it.
Real sinks, sandboxedEvery database, mailbox, and tool in a container lab is real and isolated to your session. Live targets covers exactly what's sandboxed and what a new session resets.
Which shape teaches what
The two shapes exist because some flaws only show up once there's application code and real systems in the loop.
| Category | Fits |
|---|---|
| Prompt injection (LLM01) & jailbreaks | Chat labs |
| Excessive agency (LLM03) & tool misuse | Container labs |
| MCP & agentic tool chains | Container labs |
| Improper output handling (LLM10) | Both |
Chat labs isolate the model boundary cleanly, so an injection or jailbreak flaw is visible without any other moving parts. Container labs add the application code, sinks, and sometimes an agent loop that excessive-agency, tool-misuse, and MCP flaws actually live in. You can't show that an agent mailed itself a secret without a real mailbox to prove it landed. These are shorthand — every lab still carries a precise category tag, so see the OWASP mapping for the full taxonomy, including the separate Agentic (ASI) and MCP top-ten lists.
Time, difficulty, and hints
A chat lab is usually the quicker of the two. You're attacking one conversation, so you can often reach the objective in a single sitting. A container lab takes longer, since there's a real application to explore before you even start attacking it.
Both shapes appear across the full difficulty ladder, from Beginner to Expert. The shape tells you what kind of surface you're up against, not how hard the lab will be.
Every lab also offers a small set of optional hints, staged from a nudge toward the vulnerable surface to a close description of the technique. None of them hand you the exact payload. Reaching the objective, on your own seeded target, is still on you.