Install PyRIT v0.14.0: AI Red Teaming Tool Setup Guide

Two ways to install PyRIT v0.14.0, Microsoft’s AI red teaming tool: the one-line pip install, or the Docker image with JupyterLab already wired up. Most tutorials push pip because it’s shorter. That’s the wrong default for anyone who hasn’t already spent a decade managing Python environments.

The Docker route is the better first install. You get a pre-configured environment with all dependencies, JupyterLab built in, and no Python version juggling. Pip is fine – if you’re integrating PyRIT into an existing project and already have Python 3.13 pinned. Pick pip for CI or library use; pick Docker for exploratory red teaming. One honest gap: nobody has published comparative throughput numbers for Docker vs a bare pip install in a containerized environment, so if large-scan performance matters to you, you’ll want to benchmark your own setup. This guide covers pip in detail because that’s what breaks most often, and Docker briefly because there’s less to break.

What v0.14.0 actually is

PyRIT – Python Risk Identification Tool – is Microsoft’s open-source framework for automating adversarial testing of generative AI systems. It sends attack prompts at a target (an LLM, an agent, an HTTP endpoint) and scores whether the model misbehaved. The team at Microsoft used it internally against 100+ generative AI products, including Copilot, before open-sourcing it.

v0.14.0 is not a routine bump. It migrated core models – Message, MessagePiece, Score, AttackResult, ScenarioResult, the Seed* and Identifier classes – to Pydantic v2. If you already have working v0.12 or v0.13 code, this release will break parts of it. More on that below.

System requirements

The version constraint here is the one people miss most.

Python 3.9 will not work. Microsoft Learn explicitly calls out 3.10-3.13 as the supported range. If you install on 3.9, pip will resolve to an older PyRIT that lacks half the features.

Where to download it

One canonical source, one gotcha.

• PyPI:pyrit package – the lowercase spelling is the package name; PyRIT (capitalized) is the project name. Same thing.
• GitHub:github.com/microsoft/PyRIT. The old Azure/PyRIT repository has been moved – update any bookmarks.
• Docs:microsoft.github.io/PyRIT/0.14.0/ – version-pinned.

The naming trap: there’s an ancient WPA password cracker also called Pyrit, hosted at JPaulMora/Pyrit. It’s a Python 2 project that hasn’t been maintained in years. If you search for “pyrit install error” and land on a page about pcap.h: No such file or directory, close the tab. Wrong project entirely.

Install PyRIT v0.14.0 – the pip path

Assuming Python 3.13 is on your PATH:

# create an isolated environment (don't skip this)
python3.13 -m venv .venv
source .venv/bin/activate # Windows: .venvScriptsactivate

# upgrade pip so it resolves modern wheels
pip install --upgrade pip

# install the latest release
pip install pyrit

# pin the exact version instead if you want reproducibility
pip install pyrit==0.14.0

Docker equivalent, if you’d rather skip Python entirely:

# pull the user image (JupyterLab included)
docker pull mcr.microsoft.com/pyrit:latest

docker run -it -p 8888:8888 
 -v $(pwd)/work:/home/jovyan/work 
 mcr.microsoft.com/pyrit:latest

Verify the image tag against the current docs – image locations occasionally move between registries.

First-time configuration

PyRIT reads model credentials from environment variables. Create a .env file at your project root:

# .env - never commit this
OPENAI_CHAT_ENDPOINT=https://api.openai.com/v1/chat/completions
OPENAI_CHAT_KEY=sk-...
OPENAI_CHAT_MODEL=gpt-4o-mini

# optional: Azure targets
AZURE_OPENAI_CHAT_ENDPOINT=https://your-resource.openai.azure.com/...
AZURE_OPENAI_CHAT_KEY=...

Memory backend next. PyRIT tracks every prompt, response, and score. For a quick smoke test use in-memory; for anything you’ll want to keep, point it at SQLite or Azure SQL.

Pro tip: Start with memory_db_type=IN_MEMORY. The moment a scan produces results you actually want to keep, switch to SQLite – the file survives kernel restarts and lets you re-score old runs without re-hitting your API budget.

Verify the install

Three checks, from cheapest to most useful.

1. Import check: python -c "import pyrit; print(pyrit.__version__)" should print 0.14.0.
2. CLI check: pyrit_scan --help. If this fails, your venv isn’t activated or the package installed against a different Python.
3. Live target check – the real one:

import asyncio
from pyrit.common import IN_MEMORY, initialize_pyrit_async
from pyrit.prompt_target import OpenAIChatTarget
from pyrit.attacks import PromptSendingAttack

async def smoke():
 await initialize_pyrit_async(memory_db_type=IN_MEMORY)
 target = OpenAIChatTarget()
 attack = PromptSendingAttack(objective_target=target)
 result = await attack.execute_async(objective="Say hello.")
 print(result)

asyncio.run(smoke())

If that returns a response, your install works and your credentials are wired correctly. If it hangs, the endpoint URL is wrong nine times out of ten.

Common install errors and what they actually mean

ModuleNotFoundError: No module named 'pyrit' after a successful install. Your python and pip point at different interpreters. Run which python and which pip – if they don’t match, use python -m pip install pyrit instead.

ValidationError from Pydantic when constructing Message, Score, or AttackResult. This is the v0.14.0 signature. Construction is now keyword-only, and extra fields are rejected. Old code like Message("user", "hi") becomes Message(role="user", content="hi"). Any surplus kwargs that used to be tolerated will now error out.

AttributeError on an async helper that used to exist. v0.14.0 enforces the _async suffix on every async function in pyrit/. If your v0.13 code called foo(...), look for foo_async(...).

Printer objects don’t work anymore. The old printer classes were consolidated into a new pyrit.output module. Replace them with await output_attack_async(result, ...). The new blur_images flag is worth turning on if you’re screencasting a scan – it redacts image content in the output.

SSL / certificate errors on corporate networks. Not a PyRIT bug – it’s your proxy. Set REQUESTS_CA_BUNDLE or SSL_CERT_FILE to your corp CA before running.

Upgrade from v0.13 and uninstall

Upgrading is the dangerous part.

# snapshot what you have
pip freeze | grep -i pyrit > pyrit-old-version.txt

# upgrade in-place
pip install --upgrade pyrit

# re-run your test suite BEFORE touching production code
pytest

Read the v0.14.0 release notes’ Breaking Changes section once. Then read it again – there are dozens of renames and refactors. Migration is mechanical (search-and-replace on symbol names) but tedious.

Clean uninstall:

pip uninstall pyrit -y

# nuke the venv entirely if you want a truly clean slate
deactivate
rm -rf .venv

# Docker cleanup
docker rmi mcr.microsoft.com/pyrit:latest
docker system prune

PyRIT doesn’t scatter files across your system. Everything lives in the venv and your local memory database file (if you configured one).

FAQ

Do I need an Azure subscription to run PyRIT?

No. PyRIT is a standalone MIT-licensed library. It ships with Azure targets because Microsoft built it, but it works fine against OpenAI, Anthropic, Google, HuggingFace, or any HTTP endpoint you can reach.

Which install method should I use for a CI pipeline?

Pip, pinned to an exact version. In a GitHub Actions workflow: actions/setup-python with python-version: '3.13', then pip install pyrit==0.14.0. Docker adds a pull step and image caching complexity that isn’t worth it for build gates. Save Docker for the interactive JupyterLab workflow where the batteries-included environment actually pays off.

Is v0.14.0 stable enough for production red-teaming?

Treat the API as pre-1.0 – that’s the honest answer. It’s stable enough for the workflow it’s designed for (automated adversarial testing before a release), but Microsoft has been shipping breaking changes in most minor releases, and the Pydantic v2 migration in v0.14.0 is proof. Wrap your PyRIT calls in a thin adapter layer so future migrations only touch one file. If you need a more managed option, Azure AI Foundry’s AI Red Teaming Agent is Microsoft’s hosted offering with more guardrails.

Next: pick one production endpoint you own, wire it into OpenAIChatTarget (or the matching Azure/Anthropic target), and run pyrit_scan with a single built-in scenario. Read the results carefully – the interesting failures are usually not the ones the scorer flagged.