Microsoft makes Foundry Local generally available, extends AI Red Teaming Agent with local scan

Microsoft made Foundry Local, its cross-platform runtime for running language models on end-user devices, generally available as of April 2026. The company also extended its AI Red Teaming Agent with a local scan workflow—now in public preview—that can evaluate the safety and security of those on-device models before they ship.

The pairing addresses a split in how organizations deploy inference. Cloud-hosted models introduce latency, connectivity requirements, data locality concerns, and variable token costs. Moving inference to the device sidesteps those issues, but does not make the model immune to adversarial inputs. An on-device language model can still be tricked into bypassing safeguards or generating unsafe content. Microsoft argues that systematic red teaming should be part of the on-device AI adoption process, and offers tooling to make that repeatable.

Foundry Local runs on Windows, macOS, and Linux, with SDKs for Python, JavaScript, C#, and Rust. It handles the full model lifecycle—downloading, caching, loading, inference, and unloading—within a single-user application context. The runtime ships with a curated catalog of hardware-optimized models, and developers can bring their own models in the ONNX format. It is not designed for multi-user serving; it is embedded software, not a server-side inference stack.

The AI Red Teaming Agent, built on Microsoft’s open-source Python Risk Identification Tool (PyRIT) and Foundry Risk and Safety Evaluations, generates adversarial probes, scores attack-response pairs, and computes metrics such as Attack Success Rate. Previously it targeted cloud-hosted models; the local scan workflow brings the same capability to on-device models. Developers provide a model configuration or an application callback as the scan target. The scanning itself remains cloud-assisted: adversarial prompts are generated and responses assessed by Azure services, while the model runs locally through Foundry Local. That hybrid architecture keeps inference on the device but offloads attack generation and risk scoring to Microsoft Foundry.

Microsoft published a sample solution on GitHub (foundry-local-eval) that combines both tools. The sample uses the Azure Developer CLI to provision necessary Azure resources, downloads a model from Foundry Local’s catalog, runs it locally, and feeds it adversarial prompts from the red teaming SDK. The evaluation covers four risk categories—violence, hate and unfairness, sexual content, and self-harm—and reports Attack Success Rate across attack strategies.

Organizations exploring on-device AI now have a reference implementation to compare models and tune safeguards before deployment. A trade-off: the evaluation itself currently requires cloud connectivity for adversarial generation and scoring. For now, the sample provides a structured starting point, not a turnkey solution, and teams will need to adapt it to their own threat models and risk categories.