PyRIT
Microsoft's open-source framework for automating multi-turn LLM red-team campaigns.
About
PyRIT (Python Risk Identification Tool) is Microsoft's open-source automation framework for red-teaming generative AI, built by Microsoft's AI Red Team and used across 100+ internal operations including Copilot and Phi. Instead of one-shot scans, it composes targets, prompt converters (base64, leetspeak, translation), multi-turn orchestrators like Crescendo and Tree-of-Attacks, and scorers into repeatable attack campaigns with full provenance in memory.
It is a programmer's toolkit, not a turnkey product: every workflow is written in Python, there is no CLI, and remediation guidance is explicitly out of scope. That makes it powerful for security engineers but a poor fit for teams that want a scan button.
What it can do
- Multi-turn orchestrators (Crescendo, Tree of Attacks with Pruning)
- 30+ prompt converters and obfuscation techniques
- LLM-judge and classifier scorers
- Full conversation provenance and memory
- Azure OpenAI and OpenAI target support
Setup
- Clone https://github.com/microsoft/PyRIT or
pip install pyrit. - Configure your target (OpenAI, Azure OpenAI, HuggingFace, or HTTP endpoint) with API keys.
- Write a Python script composing a target, converters, an orchestrator, and a scorer.
- Run the campaign and inspect scored transcripts in memory (SQLite/Azure SQL).
Prerequisites
Python 3.10+, familiarity with Python, API keys for target and judge models.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Microsoft AI Red Team open-source framework; battle-tested across 100+ internal operations; Tied to Microsoft's AI bounty program; ~3.6k GitHub stars reported Apr 2026; Library not product: no CLI, no turnkey scan; requires Python orchestration code; Remediation guidance explicitly out of roadmap. License: MIT (open source).
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · Microsoft AI Red Team open-source framework; battle-tested across 100+ internal operations
- · Tied to Microsoft's AI bounty program; ~3.6k GitHub stars reported Apr 2026
- · Library not product: no CLI, no turnkey scan; requires Python orchestration code
- · Remediation guidance explicitly out of roadmap
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.