Microsoft archives PyRIT red-teaming framework, leaving LLM security teams to weigh alternatives

Microsoft archived the PyRIT repository

On March 27, 2026, Microsoft archived the Azure/PyRIT repository on GitHub, according to a post on dev.to. The project is now frozen in a read-only state: no new commits, no releases and no triage of issues. As the author puts it, whatever version a team already installed through pip is the final version it will ever get.

Why the loss is bigger than a typical deprecation

PyRIT, short for Python Risk Identification Tool, was designed less as a finished scanner and more as scaffolding: a framework red teams used to script coordinated, multi-turn attack sequences against language models and the applications built on them. That distinction makes the archiving hurt more, the dev.to post argues. A completed tool that stops gaining features can still perform its old job, whereas a framework whose development has halted cuts off the adaptability teams relied on, since custom attack logic written on top of it can no longer count on upstream fixes or improvements.

What to use instead, by use case

The post sorts the alternatives according to the job PyRIT was actually doing:

• Application-layer scanning: promptfoo. Runnable with no setup via npx, it ships more than 50 red-team plugins and maps its reports onto OWASP, NIST and MITRE ATLAS frameworks, with releases still arriving regularly.
• Model-layer probing: garak. Maintained by NVIDIA, installable through pip and carrying more than 8,000 GitHub stars, it targets jailbreaks, encoding tricks and data-leakage behaviour in base models rather than the application wrapped around them, and it remains in active development.
• Continuous, OWASP-aligned detection: Giskard. Its open-source scanner is current, while the always-on Hub used for continuous scanning is a commercial product.
• Quick pre-checks: sentinel-scan-cli. A dependency-free command-line utility with parallel Python and npm implementations that produce identical output, 15 attack patterns tagged to OWASP LLM Top 10 categories, and a demo mode that runs without configuration or API keys in under a minute. The author openly discloses working on this project, so that recommendation carries a stated conflict of interest.

The orchestration gap nobody fills

According to the post, none of the above is a like-for-like substitute for PyRIT's particular strength: orchestrating multi-turn attacks. Teams whose workflows genuinely depend on that capability are pointed toward the PyRIT Community fork discussion on Microsoft's repository, or toward building a bespoke harness on top of a model API that is still maintained.

Why it matters

Red-teaming tooling has a shorter shelf life than most software, because the attacks it models evolve constantly; a frozen framework cannot keep pace with new jailbreak techniques or fresh prompt-injection variants. Teams that built custom attack sequences on PyRIT now shoulder the maintenance burden alone, and anyone with the tool sitting in a CI pipeline or on a procurement shortlist should verify its status and plan a migration.

The encouraging part, per the dev.to write-up, is that the surrounding ecosystem is in decent shape: actively maintained options exist at the application layer, the model layer and the quick smoke-test tier. The one hole left open is multi-turn orchestration itself, and for now that looks like a build-it-yourself problem.