Live targets
Every lab you open is a freshly seeded, fully sandboxed target — this page explains what that guarantees, and what it resets.
Live models, real sinks
Labs don't run against a scaled-down or scripted model. They run against the same class of production-grade model you'd meet in a real product — refusals, tone, and quirks included. In container labs, the target app acts on real downstream systems too: a database really gets a row, a mailbox really gets a message, a tool really runs. None of it reaches anything outside the lab. More on exactly what's isolated below.
Per-session seeding
Every session mints its own copy of whatever the objective revolves around: a secret, a coupon, a canary token, an account. ShopBot's VIP coupon isn't a fixed string baked into the app. Your session might mint STORE_COUPON=SUMMER30-VIP while another learner's session mints a different value entirely. Same objective, different answer underneath.
This is why an answer can't be shared. A payload or value posted somewhere after the fact carries someone else's seed, so it won't validate against yours. Reaching the objective still takes reproducing the technique, not memorising a string.
Starting a new session mints a brand-new seed. Anything you extracted under the old one — the old coupon, the old canary — stops being valid the moment the new session exists, even though the objective reads exactly the same.
Old evidence won't validateIf you retry a lab, extract the value again from your current session. A coupon or canary captured in a previous attempt belongs to a seed that no longer exists.
Sandbox boundaries
Each target app runs in its own sandbox, isolated from every other learner's session and from the open internet. Network egress is limited to the handful of internal sinks a lab actually needs — its own database, its own mailbox, its own tools — so an "exfiltrate this data" objective resolves against an internal collector, never a real external server.
When a session ends or goes idle, the sandbox is torn down. The app, its database rows, its mailbox, and anything it wrote are destroyed with it. Nothing persists between sessions, yours or anyone else's.
Model nondeterminism
Live models aren't deterministic. The same prompt can draw a refusal on one run and a compliant answer on the next, so a technique that worked yesterday might need rephrasing today. That's an honest property of live models, not a flaw in the lab.
Grading is built to absorb that variance. Canaries confirm an action actually happened rather than matching your prompt's wording, and free-form work is scored by a semantic judge that reads for the objective's outcome, not a specific phrasing. See how grading works for exactly how that scoring holds together.