Frontier Model Forum proposes a severity scale for cyber jailbreaks

The Frontier Model Forum (FMF), an industry body of frontier AI developers, has published a Jailbreak Rating Framework for Frontier Cyber Threats. Version 1.0 went up on 5 November and is open for public comment until 21 December 2026. Security and policy leads at Amazon Web Services, Anthropic, Google DeepMind, Microsoft and OpenAI each gave a supporting quote.

What it rates

The unit is one successful jailbreak: a reproducible prompt, template, multi-turn procedure or automated harness that bypasses a specific model version’s safeguards. Each is scored in four categories:

• Capability gain: how far the jailbroken model performs above a baseline.
• Capability scope: whether it works on one task, a family of tasks or across unrelated offensive categories. The top tier counts as universal.
• Ease of deployment: from sustained expert steering of each conversation up to a novice getting it on the first or second try, or running a prebuilt harness at scale.
• Ease of discovery: framed in inference spend, with example thresholds of under $10,000, $10,000 to $100,000, and above $100,000.

Tiers are ordinal and meant to be roughly logarithmic, so each step is a change in kind. Each tier pairs a plain-language definition with an operational test for experts.

The moving baseline

Capability gain is measured against the most cyber-capable widely available models at the time of assessment, currently October 2026. The FMF suggests ExploitBench and ExploitGym as initial screens and says both will need replacing as they saturate. So the same jailbreak, unchanged, scores lower as public models get stronger.

The FMF is careful about limits. The framework rates relative, not absolute, risk; a score of 0 means “below the frontier bar”, not acceptable; and the dimensions and thresholds are “a starting point for discussion rather than guidance to apply operationally”. It has not yet tested whether different assessors reach the same rating.

Why this matters

If you run a bug bounty or red-team models, these four dimensions are a ready structure for triaging jailbreak reports and explaining why one fix jumps the queue. Labs already publish cyber evaluations in their own formats, from Anthropic’s GLM-5.3 assessment to the cyber safeguards described in the Claude Fable 5.2 and Mythos 5.2 release; a shared scale would make those comparable. The comment window is the time to say whether the spend thresholds and baseline fit your own testing.