Orchestrating LLM Attacks with PyRIT

Legal and Authorized-Use Notice: PyRIT generates adversarial and potentially harmful prompts to test AI systems. Use it only against models and endpoints you own or are explicitly authorized to assess. Multi-turn orchestrators consume large numbers of tokens against both the target and the adversarial/scoring models; account for cost and terms of service. Unauthorized use is prohibited.

Overview

PyRIT (Python Risk Identification Tool for generative AI) is an open-source automation framework from Microsoft's AI Red Team, distributed at github.com/microsoft/PyRIT. Where a single-shot scanner sends one prompt and checks the answer, PyRIT automates multi-turn adversarial conversations: an attacker model and a scorer model collaborate in a loop to drive a target model toward a defined objective (for example, eliciting restricted content, leaking a system prompt, or making an agent perform an unauthorized tool call). This mirrors how real adversaries iterate against a chatbot rather than relying on one magic prompt.

PyRIT is built from composable primitives. Targets (pyrit.prompt_target) wrap the systems being probed and the hel…