AppSecNews
AI Security Open source Growing

PyRIT

by Microsoft

Python framework from Microsoft for automating adversarial probing of generative AI systems, with composable attack, transformation and scoring parts.

Visit github.com (leaves AppSecNews, opens in a new tab) Leaves AppSecNews for the vendor's own site.

No endorsements yet

Run PyRIT in production? A named recommendation helps the next team shortlisting it.

Recommend this tool

Endorsers verify their identity through LinkedIn. Titles and companies are self declared, shown as they were when each person signed, and reviewed by an editor before anything is published. Endorsements are never paid for.

What we still need to verify : 2 points in this profile are not yet confirmed against vendor documentation.
  • Current set of built in converters, orchestrators and scorers: verify against project docs
  • Supported model endpoint types beyond the major hosted providers: confirm

Treat these points as unconfirmed. They are open items in the catalog's verification queue, and this note stays until each is checked against the vendor's documentation.

What it does

PyRIT is a Python library for constructing automated attacks against generative AI systems, assembled from composable abstractions rather than shipped as a scanner. A target wraps the system under test: a hosted endpoint, a local model, or an application with its own API in front of a model. A dataset supplies seed prompts by harm category. Converters transform a prompt before it is sent, applying encodings, character substitution, translation, tone rewrites, or a fictional frame, which is how you test whether a filter keyed on surface form fails against a wrapped version of the same request. Scorers evaluate the response with pattern rules, a model judging against a rubric, or a content safety classifier.

The orchestrators are where the framework earns its place. Beyond sending every prompt once, multi turn orchestrators implement published attack patterns: an attacker model that converses with the target and adapts to refusals, gradual escalation that starts benign and moves toward the objective one turn at a time, and tree structured search that branches on partial successes and prunes failures. Prompts, responses, converters applied and scores assigned all land in a memory store, so a campaign is reproducible and results can be queried afterward rather than scrolled through in a terminal.

Where it fits

Pre release assessment and periodic reassessment of an AI system, run by a red team or an AI safety function, not by developers in a pull request. It assumes a target you can call programmatically, at least one model you are permitted to use as attacker and judge, and a clear statement of the objectives you are testing for. Multi turn orchestrators are slow, so this is campaign tooling, not a build gate.

Strengths

  • Composable design means a new attack technique is usually a new converter or orchestrator, not a fork.
  • Multi turn orchestrators implement published attack patterns rather than single shot payload lists.
  • Persistent memory of every exchange makes campaigns reproducible and results analyzable.
  • Genuinely open, with no hosted dependency beyond the models you point it at.

Limitations

  • A framework for engineers, not a product. Expect to write Python, wire your own target and read raw results without a reporting UI. Interfaces shift, so automation needs maintenance.
  • Scoring generally relies on a model as judge, adding false positives and a second source of nondeterminism on top of the target.
  • Attack quality depends on the attacker model you supply and how well you specify objectives, so two teams get different results from the same code.

Who it suits

Organizations with a dedicated red team or AI safety group able to invest engineering time in repeatable campaigns. Not appropriate for a team that wants a scanner to point at an endpoint and receive a report.

Used PyRIT? Recommend it under your own name and title.

Recommend this tool