microsoft/PyRIT v1.0.0

v1.0.0

Repository: microsoft/PyRIT

Tag: v1.0.0

Published: 2026-07-24T02:23:18Z

Prerelease: no

Release notes:

What's changed?

Welcome to PyRIT v1.0.0! This major release establishes the v1 architecture for composing scenarios, attack techniques, executors, registries, identifiers, and memory. It includes intentional breaking changes, so review the changes below carefully before upgrading.

⚠️ Breaking changes

• Scenarios now compose registered techniques — scenario strategies were renamed to techniques, the Scenario registry became the construction path, and legacy scenario scaffolding was removed (#2115, #2123, #2153).
• Component construction moved to registries — the BuildableRegistry foundation now powers attack techniques, targets, scorers, converters, scenarios, and initializers (#1963, #2057, #2087, #2101, #2122).
• Converters and attack framing were reorganized — PromptConverter is now Converter; role play, FlipAttack, and context-compliance behavior moved into techniques; system prompts are standardized on prepended_conversation, and the expired single-turn path was removed (#2040, #2160, #2161, #2177, #2178, #2245).
• Conversation and memory models changed — conversation-scoped state moved from MessagePiece into the new Conversation model, MemoryExporter/export_conversations were removed, and memory operations were consolidated (#1856, #1950, #2207).
• Pre-v1 compatibility paths are gone — APIs deprecated for 0.15 and the remaining pre-v1 internal/public compatibility shims were removed (#1951, #2111, #2195).
• Several scenario contracts changed — Jailbreak now follows a dataset × techniques × jailbreaks model, Psychosocial uses a per-subharm cross-product, and CLI/backend component construction now uses the v1 model and registry layers (#1997, #2191, #2192).

---

🧩 Framework, identity, and memory

• Introduced strongly typed component identifiers and persisted them as normalized, content-addressed graphs, making evaluation identity stable and queryable across targets, scorers, converters, scenarios, and attacks (#2007, #2050, #2164).
• Added explicit architecture boundaries for scenarios, techniques, executors, and shared layers, alongside registry-backed construction throughout PyRIT (#2089, #2107, #2124).
• Added the v1 conversation and identifier schema, a deliberate production migration guard/runbook, and bounded migration backfills for production-scale databases (#1950, #2028, #2164, #2266).

🎯 Attacks and scenarios

• Added Prompt Decomposition/DrAttack, word-game decomposition, Garak Web Injection, Garak Doctor, Policy Puppetry, and fully wired GCG extension protocols (#1902, #2003, #2051, #2064, #2067, #2070).
• Added capability-aware multimodal feedback for Crescendo, RedTeaming, and TAP; unified adversarial-chat context; and made end-of-technique converters configurable (#1377, #2053, #2066).
• Improved adaptive scenarios, iterative image state, technique metadata, scenario resume behavior, and registry alignment (#2152, #2167, #2186, #2188, #2210, #2220).

📊 Scoring

• Added composable response handlers and a pure-composition API for True/False scorers, completed by typed rubrics across the LLM scorer rollout (#2125, #2146, #2157).
• Added a dedicated LlamaGuard scorer and OWASP LLM02 output-side scorers for SSRF, SSTI, XXE, open redirect, and LDAP injection (#1867, #2118).
• Improved scorer behavior for blocked/content-filtered responses, identity configuration, and duplicate memory writes (#1989, #2022, #2072).

📚 Datasets

• Added MM-SafetyBench, XL-SafetyBench, 0DIN Threat Feed, WildGuardMix, Garak remote datasets, and a local Jailbreak dataset (#1790,...