The Frontier Model Forum, the industry body whose members are OpenAI, Anthropic, Google DeepMind, Microsoft and Amazon, has released version 1.0 of a shared framework for rating cyber jailbreaks. The Jailbreak Rating Framework for Frontier Cyber Threats scores a successful jailbreak on four dimensions and places it in one of five risk bands, from Negligible to Critical. The framework is preliminary, and the forum is taking public comment through 21 December 2026 before a revised version.
How the Scale Works
A jailbreak, in the framework’s language, is a reproducible technique that bypasses a model’s safeguards — a prompt, a prompt template, a multi-turn procedure or an automated harness. Each successful jailbreak is scored on four dimensions, each on a tier from 0 to 3: capability gain, capability scope, ease of deployment and ease of discovery.
The tiers are ordinal and use logarithmic thresholds, so each step up is several times more serious than the last. Capability gain and capability scope combine into a Severity axis, while ease of deployment and ease of discovery combine into a Likelihood axis. Their intersection places the finding in one of five bands: Negligible, Low, Medium, High or Critical.
A jailbreak that gives attackers nothing beyond what widely available models can already do stops at Negligible, however easy it is to reproduce. That gate matters: it keeps the scale focused on genuine uplift rather than on every prompt trick that slips past a filter.
Ease of discovery is measured in estimated inference spending, from more than $100,000 at the hardest tier to techniques already circulating in public. The dollar thresholds make assumptions about attacker resources explicit, and they will need revising as inference prices and search methods change.
A Baseline That Moves
The framework measures capability gain against the most cyber-capable widely available models on the assessment date, with the current reference baseline dated October 2026. It can be operationalised through the strongest results on public benchmarks such as ExploitBench and ExploitGym.
An unchanged jailbreak can therefore receive a different rating as public models improve: a technique rated Medium today could fall to Low once widely available systems offer comparable capabilities. Assessments must record the model version, evaluation date, baseline model and benchmark version, so ratings stay comparable over time.
Why the Labs Did It Now
The framework arrives at the end of a week in which cyber-capable models took centre stage. OpenAI launched GPT-6 Cyber, a model built for authorised vulnerability discovery, days before the framework appeared, and rival labs have been racing to ship cyber tools of their own.
Until now there has been no agreed method for judging how serious a jailbreak is, so the same bypass could be rated differently by every lab that found it. Amazon Web Services’ security chief put it plainly: teams knew guardrail bypasses varied in severity, but had no shared way to assess their impact.
Our Read
The framework’s real value is as a shared vocabulary, not as a verdict. A Critical rating is a prioritisation signal, not a measure of real-world harm, and the forum says so itself. But a common scale changes how disclosure works, because the same bypass can now be described in the same terms by every lab.
That coordination is already visible in practice. OpenAI has turned to outside researchers to attack its own infrastructure, and the framework gives those findings a common label the whole industry can act on. The open question is whether rival labs will actually publish their ratings, or keep the scale as an internal triage tool.
The timing also looks like the labs moving first, before regulators set the terms for them. The framework is voluntary, preliminary and explicitly not operational guidance, which is exactly the kind of industry-led standard that lets companies say a rule already exists.
Its credibility will rest on calibration: whether different assessors reach similar ratings, and whether the benchmarks it leans on stay honest as models improve. Rival cyber models are already closing the gap with the locked-down leaders, which makes a shared yardstick more urgent, not less.
Why It Matters
For security teams, the framework turns a vague warning into a comparable label: a High jailbreak at one lab means roughly the same thing at another, so triage, disclosure and remediation can finally follow one shared playbook across the industry.
For policymakers, it arrives as lawmakers in Washington weigh new rules for the industry, giving the labs a concrete answer to the question of what they are doing about AI-enabled cyber threats. The comment window through 21 December is the moment for outside experts to shape the next version.
Background
The Frontier Model Forum was set up by the leading labs to coordinate on AI safety, and its AI-cyber workstream will keep developing shared methods for assessing frontier cyber capabilities. The framework lands as governments move in the same direction, with Britain seeking powers to investigate AI agents when they go rogue.
Source: the Forum’s announcement and the framework’s technical overview
0 Comments