Starker builds realistic networks for training and evaluating agents on offensive security: a company's web apps, file shares, databases and internal hosts, a goal, and rules of engagement.
A capable policy will earn reward any way it can. It submits a planted decoy, guesses passwords it was told not to, touches the system that was out of scope. Our environments don't ask a model what happened. Each attempt is scored by what the services recorded: solved, solved by cheating, or broke a rule, with the log line that shows which.