PyRIT
What it is
PyRIT is a free, open-source framework for automated and human-led red teaming of generative AI security and safety. It supports single- and multi-turn attack strategies, including Crescendo, TAP, and Skeleton Key, and provides scenarios that combine strategies and datasets for repeatable assessments of content harms, psychosocial risks, data leakage, and other objectives. Assessments can run through a command-line scanner, interactive shell, CoPyRIT graphical interface, or custom workflows. Documented targets include OpenAI, Azure, Anthropic, Google, Hugging Face, custom HTTP endpoints and WebSockets, and web apps tested with Playwright. Its components include targets, converters, scorers, memory, datasets, attacks, and scenarios. Converters can encode, obfuscate, translate, or otherwise change prompts, as well as convert between text, images, audio, video, and files. Scorers can return Boolean or normalized scores and use LLMs, Azure AI Content Safety, or custom logic. Built-in memory tracks conversations, scores, and attack results using SQLite or Azure SQL. PyRIT is self-hosted; local installation requires Python 3.10 through 3.14.
For and against
For
- Supports single-turn and multi-turn attack strategies
- Offers CLI, interactive shell, GUI, and framework workflows
- Tests documented AI services, endpoints, WebSockets, and web apps
- Built-in memory tracks conversations, scores, and attack results
Against
- Requires a Python environment and configured AI endpoints
- Local installation lists Python 3.10 through 3.14
- Frontend contributor setup requires Node.js 22 or higher
The verdict
PyRIT offers multiple ways to run repeatable generative AI assessments, with configurable targets and scoring. Its self-hosted setup requires Python and configured endpoints.
Who it suits
PyRIT suits teams assessing generative AI systems through structured red-team exercises, as well as developers building custom assessment workflows. It requires a Python environment and configured AI endpoints.
Plans and prices
PyRIT
Open-source framework · requires a Python environment and configured AI endpoints
Read 30 Sep 2026 · microsoft.github.io
On the record
- Attack strategies
- It supports single-turn and multi-turn strategies including Crescendo, TAP, and Skeleton Key.microsoft.github.io · read 30 Sep 2026
- Compatibility limit
- The local installation page lists Python 3.10 through 3.14 as prerequisites, and the contributor setup page requires Node.js 22 or higher for the frontend.microsoft.github.io · read 30 Sep 2026
- Components
- The modular framework includes targets, converters, scorers, memory, datasets, attacks, and scenarios.microsoft.github.io · read 30 Sep 2026
- Credential handling
- In CoPyRIT, an API key entered when creating a target is stored in memory only and is not persisted to disk.microsoft.github.io · read 30 Sep 2026
- Installation
- The documentation provides local installation with pip or uv and separate Docker installation options.microsoft.github.io · read 30 Sep 2026
- Interfaces
- Users can run assessments with the command-line scanner and interactive shell, use the CoPyRIT graphical interface, or build workflows with the framework.microsoft.github.io · read 30 Sep 2026
- Memory
- Built-in memory can track conversations, scores, and attack results using SQLite or Azure SQL.microsoft.github.io · read 30 Sep 2026
- Prompt conversion
- Converters transform prompts through text operations such as encoding, obfuscation, translation, and semantic changes, as well as conversions among text, images, audio, video, and files.microsoft.github.io · read 30 Sep 2026
- Purpose
- PyRIT is an open-source framework for automated and human-led red teaming to assess the security and safety of generative AI systems.microsoft.github.io · read 30 Sep 2026
- Scenarios
- Its scenarios package attack strategies and datasets for repeatable assessments of content harms, psychosocial risks, data leakage, and other objectives.microsoft.github.io · read 30 Sep 2026
- Scoring
- Scorers can return true/false or normalized 0.0–1.0 scores and can use LLMs, Azure AI Content Safety, or custom logic.microsoft.github.io · read 30 Sep 2026
- Security
- PyRIT recommends Azure Key Vault for shared or deployed configuration and warns that plaintext .env files are less secure.microsoft.github.io · read 30 Sep 2026
- Targets
- Documented targets include OpenAI, Azure, Anthropic, Google, Hugging Face, custom HTTP endpoints and WebSockets, and web apps tested with Playwright.microsoft.github.io · read 30 Sep 2026
