PyRIT: Microsoft Open-Source AI Red-Teaming

Published September 12, 2026 — Redmond, Washington. Microsoft released PyRIT (Python Risk Identification Tool for generative AI) as a fully open-source AI red-team framework on September 10, 2026 (Microsoft Security Blog). PyRIT helps security teams identify vulnerabilities in AI systems including prompt injection, jailbreak susceptibility, content filter bypass, PII leakage, and multi-turn attack chains. Available on GitHub under MIT license.

Data last verified September 12, 2026 from Microsoft Security Blog (September 10, 2026), GitHub microsoft/PyRIT documentation, and Microsoft AI red-team research.

Quick Answer

Microsoft released PyRIT as open-source on September 10, 2026. Toolkit for AI red-teaming: prompt injection, jailbreaks, content filter bypass, PII leakage, multi-turn attack chains. MIT license on GitHub. Integrates with OpenAI, Azure OpenAI, Anthropic Claude, Google Gemini, Meta Llama. Use cases: security teams, AI developers, compliance, pentesters, researchers. Cost: free (just API costs of target AI). Industry context: first major AI vendor open-source red-team tool (Microsoft Security Blog, September 10, 2026; GitHub microsoft/PyRIT).

What PyRIT does

PyRIT is a comprehensive framework for identifying risks in generative AI systems:

Source: Microsoft Security Blog (September 10, 2026); GitHub microsoft/PyRIT.

How PyRIT works

PyRIT's architecture is designed for scalable, automated AI red-teaming:

1. Target setup: configure connection to the AI system being tested (OpenAI, Azure OpenAI, Anthropic, Google, custom models).
2. Attack selection: choose from pre-built attack scenarios or define custom attacks.
3. Attack execution: PyRIT generates attack prompts and sends them to the target AI.
4. Multi-turn chaining: AI responses feed into subsequent prompts, building attack context.
5. Mutation strategies: PyRIT applies transformations (Base64 encoding, multilingual translation, character substitution, etc.) to evade filters.
6. Scoring: AI responses are scored using automated classifiers (e.g., Azure Content Safety) and/or human review.
7. Reporting: PyRIT generates reports on vulnerabilities discovered, success rates, attack patterns.
8. Remediation guidance: identifies which safety controls (filters, system prompts, fine-tuning) should be strengthened.

The framework includes pre-built attack scenarios based on Microsoft's own AI red-team research, including: standard jailbreak attempts (DAN variants), prompt injection patterns, content filter bypass techniques, and multi-step attack chains. Custom attack scenarios can be added via Python (Microsoft, 2026).

PyRIT integrations

PyRIT integrates with major AI platforms and security tools:

Source: Microsoft Security Blog (September 10, 2026); GitHub microsoft/PyRIT.

Use cases by role

For AI security teams

AI security teams can use PyRIT to:

• Perform regular red-team exercises on production AI systems.
• Identify vulnerabilities before deployment.
• Validate security controls (content filters, system prompts, fine-tuning).
• Compare security posture across AI models (e.g., GPT-5 vs Claude vs Gemini).
• Generate compliance evidence for AI governance frameworks.
• Track security improvements over time.

For AI developers

AI developers can use PyRIT to:

• Test AI applications during development for security issues.
• Validate that safety guardrails work as expected.
• Identify edge cases that need special handling.
• Generate test cases for AI safety tests.
• Integrate PyRIT into CI/CD for continuous security testing.

For compliance teams

Compliance teams can use PyRIT to:

• Validate AI systems meet security requirements (NIST AI RMF, EU AI Act, ISO/IEC 42001).
• Generate audit evidence for AI security controls.
• Test third-party AI vendors' security claims.
• Document risk assessments for AI systems.
• Comply with regulatory requirements for AI testing.

For penetration testers

Penetration testers can use PyRIT to:

• Assess AI systems during security audits.
• Identify AI-specific vulnerabilities.
• Generate attack scenarios for client reports.
• Validate AI security controls in production.
• Combine with traditional pentest methodologies.

PyRIT technical requirements

Source: GitHub microsoft/PyRIT; Microsoft documentation.

PyRIT in the AI red-team ecosystem

PyRIT is part of a broader AI red-team ecosystem:

Source: Microsoft, NVIDIA, Protect AI, Lakera, HiddenLayer, Calypso AI (2026).

PyRIT is among the most comprehensive open-source AI red-team tools, with broader attack coverage and platform support than Garak, Rebuff, or Vigil. Commercial alternatives (Lakera, HiddenLayer, Calypso) provide enterprise features, managed services, and continuous monitoring (Microsoft, 2026).

AI red-team methodology with PyRIT

Best practices for AI red-teaming with PyRIT:

1. Define scope: which AI systems, attack scenarios, and risks to test.
2. Establish baseline: run baseline tests to understand AI's normal behavior.
3. Configure PyRIT: set up target AI, scoring criteria, attack scenarios.
4. Run automated tests: execute pre-built and custom attack scenarios.
5. Manual testing: supplement automated tests with manual creative attacks.
6. Score results: evaluate AI responses for harm, bias, leakage, etc.
7. Document findings: generate reports on vulnerabilities discovered.
8. Implement remediation: update system prompts, content filters, fine-tuning.
9. Re-test: validate remediation effectiveness.
10. Continuous testing: integrate PyRIT into CI/CD for ongoing red-teaming.

Recommended frequency: comprehensive red-team quarterly, automated testing weekly or with each model update (Microsoft, 2026).

Compliance and regulatory context

PyRIT helps organizations comply with AI safety and security regulations:

• NIST AI Risk Management Framework (AI RMF): requires testing and validation of AI systems. PyRIT provides automated red-team evidence.
• EU AI Act: high-risk AI systems require risk management, data quality, transparency, human oversight, and accuracy/robustness/cybersecurity. PyRIT supports validation of these requirements.
• ISO/IEC 42001 (AI Management System): requires risk assessment and testing of AI systems.
• Colorado AI Act (effective 2026): requires AI system developers and deployers to perform risk assessments and implement reasonable safety measures.
• NYC Local Law 144 (Automated Employment Decision Tools): requires bias audits of AI used for employment decisions.
• SOC 2 + AI controls: increasingly required for AI vendors.

PyRIT's automated red-team reports provide auditable evidence for these compliance requirements (Microsoft; NIST; EU; ISO, 2026).

Limitations of PyRIT

PyRIT has several limitations to consider:

• API access required: PyRIT needs API access to the target AI; black-box testing without API access is limited.
• AI scoring limitations: automated scoring using AI classifiers has false positive/negative rates; human review recommended for critical findings.
• Model knowledge: PyRIT's pre-built attack scenarios may not include the latest attack techniques; community contributions help but lag real-world attacks.
• Cost scaling: comprehensive red-teaming of large AI systems can cost $100-$1000+ in API fees.
• False sense of security: passing PyRIT tests does not guarantee AI system is fully secure; adversarial creativity continues to evolve.
• Specific to LLM attacks: PyRIT focuses on LLM/chatbot attacks; other AI risks (adversarial examples, model inversion, membership inference) require different tools.

PyRIT should be part of a broader AI security program, not the sole security control (Microsoft, 2026).

FAQ

Does PyRIT work with all AI models?
PyRIT works with any AI model that has an API or programmatic interface, including: OpenAI, Azure OpenAI, Anthropic Claude, Google Gemini, Meta Llama (self-hosted), Mistral, Cohere, AI21, and any custom model with API access. For models without APIs (closed models with only web interfaces), PyRIT cannot directly test but can simulate attack patterns for human evaluation (Microsoft, 2026).

How does PyRIT compare to manual red-teaming?
PyRIT automates and scales red-team testing, finding vulnerabilities that manual testing misses due to scale (millions of attack variations vs thousands). However, manual testing by experienced red-teamers identifies creative attacks, context-specific issues, and novel vulnerabilities that automated tools may miss. Best practice: combine PyRIT automated testing with periodic manual red-team exercises by experienced professionals. Microsoft recommends PyRIT for continuous automated testing plus manual red-team for major releases or annually (Microsoft, 2026).