A real target and a real adversary

Every attack so far ran against Python objects. Pointing them at a hosted model changes only the two target lines, because the attack sees only the target interface.

OpenAIChatTargetOptional

PyRIT reaches an OpenAI-compatible endpoint with OpenAIChatTarget, which reads three variables: OPENAI_CHAT_ENDPOINT, OPENAI_CHAT_KEY and OPENAI_CHAT_MODEL. Lesson 1 set these up. With a free Groq key:

python

from pyrit.prompt_target import OpenAIChatTarget

target = OpenAIChatTarget(
    endpoint="https://api.groq.com/openai/v1",
    api_key=os.environ["GROQ_API_KEY"],
    model_name="openai/gpt-oss-120b",
)

export OPENAI_CHAT_KEY=gsk_...
export OPENAI_CHAT_ENDPOINT=https://api.groq.com/openai/v1
export OPENAI_CHAT_MODEL=openai/gpt-oss-120b

With the three OPENAI_CHAT_* variables set, OpenAIChatTarget() with no arguments picks them up. On your own machine PyRIT also reads them from ~/.pyrit/.env when it starts. The adversarial target is a second OpenAIChatTarget, and the docs note it works best against a model with no content filter, so it does not refuse to write the probes.

What stays and what changes

The attack, the scorer, the converters and the memory queries are unchanged: swap ShopAssistant() for a OpenAIChatTarget and the whole course runs against a hosted model. What changes is that replies are no longer fixed, so this lesson has no captured output, and every request now counts against a rate limit, which the next lesson is about.

A real target is somebody's system. Only run these attacks against a model you own or have written permission to test, which is the rule from lesson 4 and the reason this course spent thirty lessons on one you built yourself.

Try it yourself

Set the three variables to a free Groq key and run lesson 7's attack against the model.
Point the adversarial target at the same model and run RedTeamingAttack.
Read ~/.pyrit/.env handling in the docs and put your keys there instead.

PreviousRedTeamingAttack, turn by turn

Every expert started right here.