Microsoft PyRIT: AI Red-Teaming Tool Install and Use Guide

Microsoft PyRIT (Python Risk Identification Tool for generative AI) is an open-source framework, released under the MIT license, for probing generative AI systems for safety and security risks. Researchers use it to run repeatable red-team assessments against chat models and AI-enabled applications and to keep a record of what was sent, what came back and how it was scored. Use it only against systems you own or are explicitly authorized to test.

After reading this page you should be able to decide whether PyRIT fits your study, install it, run a first single-prompt attack, and know where the results are stored. Facts below come from the project’s GitHub repository and its 1.1.0 documentation, read on 2026-11-08.

What PyRIT is used for in AI security research

PyRIT supports red teaming of generative AI: sending adversarial or boundary-testing prompts to a target and scoring the responses. The repository describes three entry points, which map to different research tasks:

Component	What it is	Typical research task
Scanner (CLI)	Command-line tool for repeatable assessments	Re-running the same scenario across model versions
CoPyRIT GUI	Browser interface for interactive, human-led testing	Exploratory probing by a human tester
Python framework	Modular library of attacks, targets, converters, scorers and memory	Custom multi-turn attack studies and new scenarios

The documentation lists automated red teaming (single- and multi-turn strategies such as Crescendo, TAP and Skeleton Key), a scenario framework covering content harms, psychosocial risks and data leakage, built-in memory (SQLite or Azure SQL), and scoring. Supported targets include OpenAI, Anthropic, Azure OpenAI, Google Gemini, AWS Bedrock, Hugging Face and Ollama, plus HTTP, WebSocket and Playwright-driven web-application targets.

Which repository to cite

The project was previously hosted at github.com/Azure/PyRIT. That repository was archived on 2026-03-27 and development continues at github.com/microsoft/PyRIT. Cite the microsoft/PyRIT URL and the exact version you ran.

Install or access (official source only)

Install from PyPI with pip install pyrit (or uv pip install pyrit). The 1.1.0 install page lists Python 3.10, 3.11, 3.12, 3.13 or 3.14, and the quick-start page recommends Python 3.13. Older documentation named a narrower range, so check the docs for the version you install. Verify the install and record the version for your methods section:

python -c "import pyrit; print(f'PyRIT version installed: {pyrit.__version__}')"

Pin the version (for example in a requirements file) so that a later reader can reproduce the run. The documentation notes that the notebooks must match the installed version.

Configure a target

The quick start reads settings from a ~/.pyrit/.env file. For an OpenAI-compatible chat target it expects OPENAI_CHAT_ENDPOINT, OPENAI_CHAT_KEY and OPENAI_CHAT_MODEL. A ~/.pyrit/.pyrit_conf file sets memory_db_type: in_memory plus target and scorer initializers. Keep keys out of shared notebooks and repositories.

Step-by-step: send a first prompt

The documentation’s quick start sends one objective to a chat target and prints the conversation. It uses top-level await, so run it in a notebook or other async context.

1. Install PyRIT and create ~/.pyrit/.env with the three OpenAI chat variables above.
2. Run the following:

from pyrit.executor.attack import PromptSendingAttack
from pyrit.output.attack_result.pretty import PrettyAttackResultMemoryPrinter
from pyrit.prompt_target import OpenAIChatTarget
from pyrit.setup import IN_MEMORY, initialize_pyrit_async

await initialize_pyrit_async(memory_db_type=IN_MEMORY)
target = OpenAIChatTarget()
attack = PromptSendingAttack(objective_target=target)
result = await attack.execute_async(objective="What model exactly are you? be concise.")
printer = PrettyAttackResultMemoryPrinter()
await printer.write_async(result)

Using the command-line scanner

The docs show pyrit_scan run airt.scam --target openai_chat as an example scan and pyrit_scan --help for options. pyrit_shell opens an interactive shell, and pyrit_backend serves the CoPyRIT GUI at http://localhost:8000/.

Output and how to read it

The printer writes the conversation turns for the attack result. For systematic work, three concepts determine how to read results:

• Targets are the systems being tested; converters transform prompts before they are sent; scorers judge the responses.
• Scoring can be true/false, Likert-scale, classification or custom, so state which scorer type produced any number you report.
• Memory stores prompts, responses and scores. The quick start uses an in-memory database, which is discarded at exit; the documentation lists SQLite and Azure SQL as persistent options, which is what you need if results must be audited later.

For a reproducible record, report the PyRIT version, target model identifier, attack strategy, scorer type and the stored memory export. Automated scores are a screening signal; a human should review flagged responses before any claim is made about a model.

Troubleshooting

• Syntax error on await: the quick start assumes a notebook or async context where top-level await is allowed.
• Target fails to initialize: check that the endpoint, key and model variables are set in ~/.pyrit/.env.
• Notebook examples behave differently from your install: the docs state notebooks must match the installed version, so open the documentation for your pinned version.
• Results vanish after a session: you used the in-memory database; configure a persistent memory type.

Free alternatives

Tool	Notes
PyRIT	MIT-licensed; scanner, GUI and Python framework (Microsoft)
garak	LLM vulnerability scanner; see the CASRAI guide to garak

For the threat-taxonomy side of adversarial testing, see MITRE ATLAS, which catalogues adversary tactics against AI systems.

FAQ

What does PyRIT stand for?

Python Risk Identification Tool for generative AI, per the project’s repository.

Is PyRIT free?

It is open source under the MIT license.

Can I use it on any chatbot?

Only on systems you are authorized to test. Check the terms of any hosted service before running automated attacks.

Where is the official documentation?

At microsoft.github.io/PyRIT, listed below.

Sources

• microsoft/PyRIT repository, read 2026-11-08.
• PyRIT documentation 1.1.0, read 2026-11-08.
• PyRIT local install instructions, read 2026-11-08.