Photo: Tara Winstead / Pexels
Version 1.0 scores jailbreaks on severity and likelihood, giving labs and policymakers a shared way to rank cyber risk from frontier models
The biggest AI labs now have a shared scorecard for one of their least comfortable problems: people tricking their models into helping with cyberattacks.
The Frontier Model Forum (FMF) has published Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats. It offers a structured way to rate how dangerous a successful cyber jailbreak actually is.
The release landed on November 5, 2026. The FMF calls it a preliminary framework, which is a polite way of saying the rulebook is still open for edits.
How the scoring works #
A jailbreak is any technique that gets an AI model to ignore its safety guardrails and do something it was built to refuse.
The framework sorts jailbreaks across four categories:
Capability gain: how much extra offensive ability the jailbreak unlocks.
Capability scope: how broad that unlocked ability is.
Ease of deployment: how simple the technique is to actually use.
Ease of discovery: how easily someone could find the technique in the first place.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Those four inputs feed a scoring system that maps onto two axes, Severity and Likelihood. The result is an overall risk classification that runs from Negligible at the low end to Critical at the top.
The practical upshot is triage. A jailbreak that is hard to find, hard to use and grants little new capability lands low. One that is easy to stumble on and hands over serious offensive power gets flagged for urgent attention.
Why the labs built it together #
The FMF describes its goal as building a shared understanding of cyber-related jailbreaks. The intended audience spans AI developers, security researchers and policymakers trying to interpret emerging threats.
The framework was developed by FMF members drawing on their own internal security expertise. The AI Security Institute (AISI) also provided input during development.
OpenAI and other Forum members positioned the framework as a tool for rating cyber jailbreak risk and prioritizing stronger safeguards. Experts at AISI have endorsed it as a meaningful contribution to technical best practices in AI security.
The Forum’s track record so far #
The Frontier Model Forum was founded in July 2023. Its members include Amazon, Anthropic, Google, Meta, Microsoft and OpenAI.
This release builds on earlier work, including a February 2026 information-sharing agreement covering threats and vulnerabilities. That agreement dealt with passing intelligence between labs. The new framework tackles a related question: once a threat is identified, how worried should everyone be?
What this means for labs, researchers and regulators #
The most immediate effect is standardization. Before a shared framework, one lab’s “serious” jailbreak could be another lab’s “minor” one, making cross-industry comparisons messy. A common scale lets organizations compare notes without translating each other’s internal jargon.
For security researchers, the framework could make disclosures more consistent. A researcher reporting a jailbreak can frame it using the same four categories a lab will use to evaluate it.
For policymakers, the value is legibility. A published methodology with defined categories and risk bands gives them something concrete to examine, question and potentially reference.
The framework was built largely by the companies whose models it evaluates, with outside input from AISI.
The FMF has said the framework will be updated iteratively based on public comments. The comment period runs until December 21, 2026.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.