Microsoft's AI Red Team published AI Red Teaming 101 on Microsoft Learn in July 2025. It is ten short episodes in three parts: fundamentals, core attack techniques, and automation. PyRIT, the team's open-source Python Risk Identification Tool, gets around 900 searches a month on its own, and this series is the friendliest way into it. The first two episodes cover what AI red teaming is and how generative models work, enough to explain why they fail differently from ordinary software. Episodes three to six are the core: direct prompt injection (with the well-known case of a dealership chatbot agreeing to sell an SUV for a dollar), indirect injection through emails, documents and web pages, single-turn tricks like persona hacking and encoding, and multi-turn techniques like Skeleton Key and Crescendo that walk a model past its guardrails over several messages.
Episode seven covers defences, mostly Microsoft's spotlighting methods of delimiting, marking and encoding untrusted data. Episodes eight to ten move to PyRIT, showing how to set up datasets, targets and scorers and then automate single-turn and multi-turn attacks, including against image generators. The labs are the best part. Microsoft released the AI Red Teaming Playground Labs under MIT licence on GitHub: 12 challenges graded easy to hard, covering metaprompt extraction, credential exfiltration, Crescendo, indirect injection and guardrail bypass. They were originally the hands-on part of a Black Hat USA 2024 training run by Dr.
Amanda Minnich and Gary Lopez. You run them with Docker Compose and your own OpenAI or Azure OpenAI key. That setup is a small barrier, but it means you are attacking a real model, not a canned simulation. PyRIT itself is the reason this ranks so high for me. It is a working framework with about 4,600 GitHub stars, regular releases and a Discord, not a teaching toy.
Once you understand its orchestration, converters and scorers, you can point it at your own chatbot or agent and run hundreds of attack variations with logged results. One practical warning: the repo moved from Azure/PyRIT to microsoft/PyRIT and the old one was archived in March 2026, so blog posts and older tutorials often send you to the wrong place. The weaknesses are about scope. There is no certificate, so if you need a credential look at paid options. The defence material is thin, and spotlighting is one approach among several, not a complete answer to prompt injection.
Nobody has a complete answer yet, and I would have liked the series to say that more bluntly. It is also strongest on chat-style models. Agentic attacks, where the model has tools and can take actions, get less attention than they deserve in 2026. I give it 4.4. Free, credible, hands-on, and it leaves you with a tool you will actually keep using.
Watch the episodes in an afternoon, then spend a weekend on the labs.