Live targets
Every lab you open is a freshly seeded, fully sandboxed target — this page explains what that guarantees, and what it resets.
Live models, real sinks
Labs use the same class of production-grade model you'd encounter in a real product, including its refusals, tone, and quirks. The models aren't scaled-down or scripted. In container labs, the target app also acts on real downstream systems: it writes database rows, delivers messages to a mailbox, and runs tools. These actions stay within the lab. The isolation boundaries are described below.
Per-session seeding
Every session generates its own copy of the value used in the objective: a secret, a coupon, a canary token, an account. ShopBot's VIP coupon isn't a fixed string built into the app. Your session might generate STORE_COUPON=SUMMER30-VIP while another learner's session generates a different value for the same objective.
A shared answer won't validate against your session because the posted payload or value carries someone else's seed. Completing the objective requires reproducing the technique; memorising a string won't help.
Starting a new session generates a new seed. Values extracted in the old session, such as a coupon or canary, become invalid as soon as the new session exists, even though the objective is unchanged.
Old evidence won't validateOn a retry, the value must be extracted again from the current session. A coupon or canary captured in a previous attempt belongs to a seed that no longer exists.
Sandbox boundaries
Each target app runs in its own sandbox, isolated from every other learner's session and from the open internet. Network egress is limited to the few internal sinks the lab needs, such as its own database, mailbox, and tools. An "exfiltrate this data" objective uses an internal collector, never a real external server.
When a session ends or goes idle, its sandbox is destroyed, along with the app, its database rows, its mailbox, and anything it wrote. Nothing persists between sessions, yours or anyone else's.
Model nondeterminism
Live models aren't deterministic. The same prompt can produce a refusal on one run and a compliant answer on the next, so a technique that worked yesterday might need rephrasing today. This variability is expected behaviour for live models.
Grading accounts for that variance. Canaries confirm that an action happened rather than matching your prompt's wording. Free-form work is scored by a semantic judge that checks the objective's outcome rather than specific phrasing. See how grading works for details.