PyRIT v1.1.0

What it is

PyRIT v1.1.0, Microsoft's Python AI red-teaming framework (Python >=3.10, <3.15). This release improves scoring, expands the scanner, and adds CoPyRIT (the GUI) features — but it carries breaking changes that require code and deployment changes before upgrading. The page also documents the v1.0.1 patch (structured refusal handling) and the v1.0.0 architecture rewrite beneath it.

What to do

Before upgrading to v1.1.0, handle four breaking changes:

• Undetermined scores. Scores can now be undetermined. Check score.is_undetermined before reading score_value or calling get_value() (#2491) — existing code that reads these unconditionally will break.
• Partial blocked responses now scored by default. To keep prior behavior, set should_score_blocked_content=False.
• CoPyRIT auth moved to Microsoft Graph. Authenticated deployments now require an allowed-group configuration (#2281).
• New fixed-egress CoPyRIT deployment requires a parallel Azure Container Apps environment; Azure SQL deployments also require new migrations (#2438).

If you are jumping from v1.0.0 and use OpenAIResponseTarget/OpenAIChatTarget, note the v1.0.1 compatibility change: reasoning pieces are now ordered after actionable response pieces, so [reasoning, text] becomes [text, reasoning] for models like GPT-5. Code indexing message_pieces[1] for the answer will now read the reasoning blob. Select by type instead:

text_piece = response[0].get_piece_by_type(data_type="text")

Notable additions (not requiring action)

• Scoring: new Roblox PII, ShieldGemma, and system-prompt-extraction scorers; fixes to aggregation and non-finite value handling (#2579).
• Scanner: Best-of-N, split-payload, multilingual, package-hallucination, and FigStep capabilities; 10 new converters (bijection, CharNoise, CodeAttack, SATA, Vigenere, Acrostic, IPA).
• Datasets: 488 TrustAIRLab in-the-wild jailbreak templates plus the Menz et al. datasets.

Security

The release states no known high-priority security issues. It moved CoPyRIT auth/group authorization to Microsoft Graph, constrained HTTPXAPITarget upload paths, made dataset cache updates atomic, and updated dependencies with available patches. (Prior releases fixed named CVEs — e.g., v0.12.1's Jinja2 SSTI, and starlette CVE-2026-48710 / idna CVE-2026-45409 in v0.14.0 — if you are upgrading across those.)

Caveats

The v1.1.0 "Full list of changes" is truncated by the fetch (the page is ~70K characters; only the first 60K were shown, cut off mid-changelog around #2325). Additional PRs, new-contributor notes, and any later release entries below v0.10.0rc0 are not visible here — confirm the complete changelog and migration guide on the release page before upgrading a production deployment.