PyRIT (Python Risk Identification Tool) is an open-source automated red-teaming framework. Where a static dataset is a fixed list of adversarial prompts, PyRIT orchestrates multi-turn attacks: a 'red' agent generates attempts, a 'target' is the system under test, a 'scorer' judges success, and an 'orchestrator' iterates and adapts. It supports converters (encoding tricks, paraphrase), strategies (single-turn, multi-turn, tree of attack), and pluggable scorers. The output is an adaptive attack success rate metric across attack families, suitable for CI-style safety regression testing.
**PyRIT (Python Risk Identification Tool)** is Microsoft's open-source framework for automated LLM red-teaming. The key word is framework, not dataset.
A static prompt-attack dataset is a fixed list of adversarial prompts. You send each one to your model, count how many it falls for, and you have a number. Useful, but the number stops improving the moment the model's training data overlaps with the dataset, and the dataset cannot probe multi-turn dynamics or learn from what worked.
PyRIT is built around four pluggable components:
- **Target.** The system under test, an LLM endpoint, an agent, a RAG pipeline.
- **Red agent.** Generates attack attempts, often itself an LLM, sometimes a deterministic strategy.
- **Scorer.** Judges each response: was the attack successful (did the target comply with the off-policy request)?
- **Orchestrator.** Coordinates the loop, feeds the red agent's next attempt to the target, gets the response, asks the scorer, and decides whether to iterate, escalate, or stop.
PyRIT also includes **converters** that transform a base prompt (encode in base64, translate, paraphrase, append role-play framing) and **strategies** (single-turn, multi-turn, tree of attacks) that structure the attack flow.
The output is an attack success rate per attack family, suitable for tracking over time as a safety regression metric in CI.
The production value: every time you upgrade your model, retrain a fine-tune, or change a system prompt, PyRIT runs against the new build and tells you whether your attack success rate moved the right direction.
**PyRIT** is Microsoft's open-source Python framework for orchestrating automated, adaptive red-team campaigns against LLM systems. It is the most widely-used 2026 framework for moving red-team from a one-shot artisanal exercise to a continuous regression-tested process.
**The four-component architecture.**
- **Target**, the system under test. Can be an LLM endpoint (Azure OpenAI, Anthropic, OpenAI direct), an agent (LangChain, AutoGen), a RAG pipeline, or any callable that takes input and returns output.
- **Red agent**, generates attack attempts. Often itself an LLM (uncensored or specifically tuned for attack generation); sometimes a deterministic pattern generator.
- **Scorer**, judges whether each response constitutes a successful attack. Pluggable: keyword scorers for simple checks, LLM-as-judge for nuanced policy evaluation, custom Python for specific failure conditions.
- **Orchestrator**, coordinates the loop. Decides when to iterate, when to escalate, when to switch strategies.
**Pluggable extensions.**
- **Converters** transform a base prompt: base64 encoding, leetspeak, language switching, paraphrase, role-play wrapping, instruction-following splits. Probe whether superficial transformations bypass classifiers.
- **Strategies** structure the attack flow: single-turn (one attempt), multi-turn (conversational attacks that build pressure), tree of attacks (TAP-style branching exploration), Crescendo (gradually escalating manipulation).
- **Datasets** import known attack corpora (HarmBench, AdvBench, JailbreakBench) as starting prompts for converters and strategies to vary.
**Output and integration.**
The output is structured: per attack family attack success rate, per-strategy ASR, traces of each conversation. The metrics are queryable in pandas-style dataframes and exportable to dashboards.
Quick reference
TL;DR
PyRIT is Microsoft's open-source red-teaming framework that orchestrates adaptive multi-turn attacks against an LLM system, with pluggable converters, strategies, and scorers, producing attack success rate metrics
Imagine testing a castle's defences. The lazy way is to walk around the walls once with the same set of test attacks, write down what worked, and call it done. The thorough way is to bring an entire team: one person crafting new attempts, another adjusting them based on what the previous one tried, a third deciding whether each attempt actually breached the wall, and a coordinator running the whole exercise over hours and rotating tactics. PyRIT is the second approach for LLM systems. It is not a list of attacks to try; it is an orchestration framework where attackers learn from previous turns and adapt, scorers automatically judge success, and you get back a metric of how well your model held up across many attack families.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
One-off exploratory red-team where human creativity is the value PyRIT scales known attack families; novel-attack discovery is still better done by human red-teamers who can find the next family.
Very early prototype with no safety surface to protect ASR metrics on an unhardened prototype are uninformative; invest in basic guardrails first, then run PyRIT against the hardened version.
Pure compliance-checklist demand with no actual safety review intent Running PyRIT to satisfy a checklist without acting on the results is theatre; the value is the regression loop and the response to findings.
Quick scan · 2–4 min
Everything important, quickly.
6 min: framework vs dataset distinction + four core components + pluggable converters and strategies + scorer design and chained validation + CI integration as release gate + composition with guardrails and online sampled eval + Garak comparison.
Real-world examples
Real products, models, and research that use this idea.
1Microsoft AI Red Team uses PyRIT internally as the backbone of Azure OpenAI safety regression in 2026.
2Anthropic's Frontier Red Team incorporates PyRIT-style orchestrators alongside in-house tooling for pre-deployment safety review.
3MLCommons AILuminate benchmark uses PyRIT-compatible orchestration for its public LLM safety scoring.
4The OpenAI Preparedness team published a 2024-2025 report describing automated red team usage that aligns architecturally with PyRIT's design.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you design the scorer for a high-stakes safety regression run?
Sign in or go Pro to see the approach for this follow-up.
QHow does PyRIT's orchestration interact with the dual-LLM defence pattern?
Sign in or go Pro to see the approach for this follow-up.
QWhat is the right ASR threshold for a release gate?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Treating PyRIT as a dataset of attack prompts. PyRIT is an orchestration framework; the attacks are adaptive and multi-turn, not a fixed list to evaluate against.