Quick one: if PyRIT (Microsoft's Python Risk Identification Tool) is on your shortlist for LLM red-teaming, check the repo first. Azure/PyRIT
was archived on GitHub on March 27, 2026. It's read-only now: no commits, no releases, no issue triage, nothing. Whatever version you pip-installed is the last version you'll ever get.
That matters more for PyRIT than it would for most tools, because PyRIT was never a turnkey scanner. It's a framework for scripting multi-turn attack orchestration, the kind of thing a red team builds custom attack sequences on top of. A framework that's stopped shipping fixes is a worse foundation to build on than a finished tool that's stopped shipping features, because you were relying on it staying flexible to your needs, and now it can't.
So what do you use instead? Depends on what you were actually using PyRIT for:
npx promptfoo
, 50+ red-team plugins, OWASP/NIST/MITRE ATLAS report mappings, and it's still getting regular releases.--demo
runs with no config and no API keys in under a minute.None of these replace PyRIT's specific multi-turn orchestration model one-for-one, if that's genuinely what you need, Microsoft's PyRIT Community fork discussion or building your own harness on top of a maintained model API is probably the honest answer now. But if you were reaching for PyRIT as a general "test my LLM thing for prompt injection" tool, one of the four above almost certainly covers your case and is still getting updates.
We went deeper on all five (well, four now) tools, what layer they test, and where each one actually fits, in the full comparison guide, updated today to reflect PyRIT's archived status.
Full disclosure: I work on sentinel-scan-cli, so weigh that mention accordingly.