#1515th of 22 in Security
pyrit
AI red teaming toolkit for scanning generative AI models and applications
- Stars
- 4.8k
- License
- MIT
- Last commit
- Nov 2026
- Last release
- Sep 2026
- Language
- Python
3,715 on 22 Apr 20264,800 on 11 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
PyRIT is a Microsoft AI Red Team toolkit for finding security and safety weaknesses in generative AI systems. It offers a command-line scanner for repeatable assessments, a browser GUI called CoPyRIT, and a Python framework for building custom attack workflows, including adaptive multi-turn attacks. Targets include many hosted and local model providers as well as full applications over HTTP, WebSockets or Playwright.
Who it is for: Red teamers and security engineers testing generative AI systems
Strengths
- Three interfaces: CLI scanner, CoPyRIT browser GUI, and extensible Python framework
- Connects to OpenAI, Anthropic, Bedrock, Vertex AI, Ollama, Hugging Face and more
- Can test whole applications via HTTP, WebSocket or Playwright browser targets
- Maintained by the Microsoft AI Red Team; MIT licensed with recent commits
Weaknesses
- Extra providers beyond built-in ones need the optional LiteLLM adapter
- Feature availability varies by target and model
- No Docker or compose setup shipped in the repo
- Requires API keys or secrets configured per provider
What it needs
- Docker + Compose
- Needs Model provider API keys, Playwright (optional, browser targets), LiteLLM (optional adapter)
- Models: OpenAI, Anthropic, Azure OpenAI, Microsoft Foundry, Azure Machine Learning
What changed
“Scores can now be undetermined. Check score.isundetermined before reading scorevalue or calling getvalue() (#2491).”
“No known high-priority security issues.”
“Scenarios now compose registered techniques — scenario strategies were renamed to techniques, the Scenario registry became the construction path, and legacy scenario scaffolding was removed (#2115, #…”
CVE-2026-53550, GHSA-H67P-54HQ-RP68. “Hardened archive extraction, Azure Blob URL validation and metadata filenames, Entra-auth forwarding, and Key Vault provisioning (#1957, #2049, #2180, #2183, #2193).”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Security
See all 22| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source analysis | 92 out of 100 |
| 2 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 87 out of 100 |
| 3 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 84 out of 100 |
| #4 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 79 out of 100 |
| #5 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 78 out of 100 |