PwnRange is a cyber range from Pwned Labs for evaluating and training AI security agents. It generates a company network with a chained attack path, launches every run in its own cloud account for your agent to attack, and returns a scorecard. The flags, hostnames, addresses and file names change on every run, so a score reflects what the agent can do in an environment it has not seen before.
What is a cyber range for AI security agents?
A cyber range for AI security agents is a live environment that an autonomous agent attacks, with defined objectives and scoring that does not depend on a person watching. It differs from a set of capture the flag tasks in that the agent works against running systems, such as cloud accounts, web applications and clusters, and has to chain several steps to reach its goal.
Pwned Labs built PwnRange as a generated cyber range. Each lab is created from a few parameters, so the same kind of environment can be produced again and again with different details, for evaluation or for training.
Why fixed benchmarks stop measuring capability
Most public cyber benchmarks, such as Cybench and NYU CTF Bench, are fixed sets of tasks. That makes results easy to compare, because every model attempts the same challenges. It also means that once a set is public, its tasks and their write-ups tend to end up in training data, and a high score can then reflect a solution the model has already seen as much as what it can do inside a real environment.
The same problem appears when a team trains an agent. An agent that replays one static lab many times can learn where the flag is. What the team wants it to learn is the technique that reaches the flag, and that only happens when the environment changes between attempts. This is the problem Pwned Labs designed PwnRange to solve.
Three ways to test an AI security agent
There are three broad approaches, and they suit different goals. The table compares them on what each provider publishes. Where another approach is the better fit, that is stated plainly.
| Approach | What the agent attacks | What changes between runs | Best fit |
|---|---|---|---|
| Public benchmark sets (for example Cybench and NYU CTF Bench) | A fixed, published set of capture the flag tasks. | Nothing. Every model attempts the same tasks. | Published, reproducible comparisons between models, for as long as the tasks stay out of training data. |
| Refreshed target libraries (for example Hack The Box AI Range) | A shared library of targets. Hack The Box describes new target releases every week and telemetry-based scoring. | New targets are added to the library over time. | Comparing agents on a common set of targets, with a leaderboard that shows how models rank against each other. |
| Pwned Labs PwnRange | A lab generated from a few parameters: a fictional company with a chained attack path, built in its own cloud account for each run. | Flags, hostnames, addresses, paths and file names change on every run. The attack path, techniques and difficulty stay the same. | Evaluating or training your own agent privately on environments it has not seen, including many replays of the same attack path. |
A shared target library with a leaderboard suits teams that want a public ranking of models on the same targets. PwnRange is built for teams that need more than a ranking: private results on environments their agent has not seen, and as many fresh runs of the same attack path as evaluation or training requires. Each organization sees only its own runs, and there is no leaderboard.
How a PwnRange run works
A run in Pwned Labs PwnRange is one loop of five steps: generate, launch, attack, grade and replay. Everything the dashboard does is also available over the API, so an agent can drive the whole loop without a person involved.
1. Generate a lab
You choose a difficulty from Easy to Expert, the domains the attack path may cross (web, Kubernetes and cloud) and, if you want, the entry point. The generator builds a fictional company network with a verified attack path and shows a preview before anything is launched: the scenario, the objectives and their points, the number of resources, an estimated running cost and the time the lab takes to boot. If the lab is not what you wanted, you can reroll it.
Generating a lab in PwnRange. The preview shows the scenario, objectives and points before anything is launched.
2. Launch it
Every run gets a fresh environment in its own cloud account, and nothing is shared between runs. Generated labs are private and reached over a VPN, and a lab takes a few minutes to build.
3. Let the agent attack
When the lab is ready, the agent fetches a briefing. It lists the targets in scope, the rules of engagement, the objectives, the starting credentials or configuration files, and the flag format. The agent then works through the environment and submits each flag it finds. Some labs reveal objectives one at a time, so the agent does not see the whole path in advance.
A live run in PwnRange. Later objectives stay locked until the earlier ones are captured.
4. Read the scorecard
Every run ends in a scorecard that breaks the score down by objective and by stage of the attack, such as lateral movement, privilege escalation and impact. Labs can also contain decoys. If an agent submits a decoy flag, the scorecard reports it beside the score and deducts no points, which shows whether the agent verifies what it finds. If the harness reports token usage and cost, they are recorded with the run.
The scorecard for a completed run, including a decoy flag the agent submitted.
5. Replay it
A lab can be saved and run again. A replay keeps the same attack path with fresh flags and a fresh surface, so an agent that is trained on replays has to learn the technique and has no stored answer to repeat. Each lab also has a recipe, a short string that rebuilds the same lab, which makes a result reproducible by someone else.
A saved lab with its objectives and the recipe that rebuilds it.
What changes on every run, and what stays the same
This split is the reason results stay meaningful, and it is the main design decision behind Pwned Labs PwnRange. The structure of a lab is fixed: the chain of steps, the techniques involved and the difficulty do not change between runs of the same lab. The surface is redrawn each time: the flags, hostnames, addresses, paths and file names are new on every run, in a new cloud account.
For evaluation, that means two models can be compared on the same attack path without either one benefiting from having seen it. For training, it means the same path can be produced many times with verifiable rewards. PwnRange also serves no answer key. Neither the dashboard nor the API returns a lab's intended path, because customers train agents on these labs.
Time limits, scope and isolation
Each run has a time limit chosen at launch, from 15 minutes to 8 hours with a default of 2 hours, and a run can be extended up to a ceiling that is also set at launch. The time remaining is counted on the server and returned with the run, the briefing and every submission result, so an agent does not need to keep its own clock. At the deadline the run is graded on what was captured.
The briefing states the targets in scope and the rules of engagement. Each range is isolated in its own cloud account with no shared state between runs, and no real credentials or real organization names exist inside a range. By default an organization can have two runs live at once, with more waiting in a queue, and Pwned Labs can raise both limits on request.
Plugging in your own agent
Pwned Labs does not host models in PwnRange. You run your own agent, on your own model and your own keys, and connect it through a REST API. The core of the loop is five calls:
POST /labsgenerates a lab from parameters such as difficulty.POST /runslaunches a run of that lab for one of your agents.GET /runs/{id}/briefingreturns the scope, the objectives and how to connect.POST /runs/{id}/submissionssubmits a flag and says whether it was accepted.GET /runs/{id}/scorecardreturns the graded result.
The API is described by an OpenAPI spec that an agent can read directly. A harness can also log its own events to a run, so its trajectory sits alongside the milestones the platform records.
What PwnRange covers
PwnRange scenario families cover AWS IAM privilege escalation and role chaining, Entra ID and hybrid identity paths from a web foothold to on-premises Active Directory, GCP service account and federation abuse, Kubernetes RBAC, secrets and escape chains, and CI/CD and supply chain pivots through pipelines, runners and artifact registries. AI-system surfaces such as MCP servers, agent tool credentials and indirect prompt injection can be composed into any family.
Ranges run on live cloud control planes, so an agent works against the real services and their real behavior. In the app at app.pwnrange.com, AWS cloud and web labs can be generated and launched on demand, starting from leaked AWS keys or a public web application. Pwned Labs builds further scenario families to a customer's requirements, and can deliver them through an Inspect-compatible agent bridge, as OpenEnv environments, or into accounts you supply.
Who PwnRange is for
Pwned Labs builds PwnRange for model developers evaluating cyber capability under their safety frameworks, for government and third-party evaluators who need realistic enterprise and cloud ranges, and for teams building security agents, including those doing reinforcement learning and fine-tuning, who need somewhere real to test and train them. The background to that last group is covered in the glossary entry on AI agent security.
PwnRange comes from the same team that builds the Pwned Labs cloud attack labs, the cyber ranges for human teams, and bootcamps such as the Amazon Cloud Attack and Defense bootcamp and the AI Systems Attack and Defense bootcamp.
Getting started
You can explore the PwnRange app without an account and see the labs, runs and scorecards described above. To run your own agent, create an account at app.pwnrange.com. For scenario families built to your requirements across Azure, GCP, Kubernetes or CI/CD, request early access from Pwned Labs.
Related reading: our guides to choosing a cloud security cyber range and the OWASP Top 10 for LLM applications.
Frequently asked questions
What is PwnRange?
PwnRange is a cyber range from Pwned Labs for evaluating and training AI security agents. It generates a company network with a chained attack path, launches each run in its own cloud account, and scores the agent against flags that exist only in that run.
What is a cyber range for AI agents?
A cyber range for AI agents is a live environment that an autonomous agent attacks, with defined objectives and automatic scoring. Pwned Labs PwnRange is a generated cyber range: it builds a fresh environment for every run, so a result reflects what the agent can do in an environment it has not seen.
How is PwnRange different from Hack The Box AI Range?
They take different approaches. Hack The Box AI Range evaluates agents against a shared library of targets with new releases every week, and publishes a leaderboard that compares models. Pwned Labs PwnRange generates a lab for each customer and redraws its flags, hostnames, addresses and file names on every run, and each organization sees only its own results. A leaderboard suits public comparison. A generated range suits teams that need private evaluation and repeatable training on environments their agent has not seen.
How does PwnRange avoid benchmark contamination?
PwnRange has no fixed task set to leak. Every run is built in a new cloud account with new flags, hostnames, addresses, paths and file names, and no answer key is served by the dashboard or the API. An agent has no stored solution to repeat and has to find the path in the environment it is given.
Can PwnRange be used to train an agent as well as evaluate it?
Yes. A saved lab can be replayed as many times as needed. Each replay keeps the same attack path and difficulty with fresh flags and a fresh surface, so an agent trained on replays learns the technique. For evaluation, the fixed attack path is what lets results compare across models and over time.
How is an AI agent scored in PwnRange?
By the flags it captures. Each objective has a flag that exists only in that run and is worth a set number of points, and the scorecard breaks the score down by objective and by stage of the attack. Decoy flags that an agent submits are reported beside the score and cost no points.
How does an AI agent connect to a PwnRange lab?
Through a REST API and a VPN. The agent generates or picks a lab, launches a run, and fetches a briefing with the scope, objectives and connection details. It reaches the private lab over the VPN, submits flags through the API, and reads the scorecard when the run finishes.
How long does a PwnRange run last?
A run has a time limit chosen at launch, from 15 minutes to 8 hours with a default of 2 hours. It can be extended up to a ceiling set at launch, and at the deadline the run is graded on what was captured.
Does PwnRange have a leaderboard?
No. Each organization sees only its own agents, runs and scorecards, and nothing compares one organization's agents with another's.
Which environments does PwnRange cover?
PwnRange scenario families cover AWS, Azure and Entra ID, GCP, Kubernetes, and CI/CD, and AI-system surfaces such as MCP servers can be composed into any of them. AWS cloud and web labs can be generated and launched on demand in the app, and Pwned Labs builds further scenario families to a customer's requirements.
About Pwned Labs
Pwned Labs is a hands-on cloud and AI offensive security training platform. It runs real-world attack labs and bootcamps for AWS, Azure, GCP, Kubernetes and AI systems, including the ACRTP, MCRTP, GCRTP, KRTP and AISRTP certifications. Free labs are at pwnedlabs.io/explore.