New framework grades AI jailbreaks across capability gains, scope, and how easy they are to deploy — Frontier Model Forum proposes CVSS-style rating system for new AI models

In recent months, high-profile headlines about AI models letting loose from their safeguards dominated headlines. Now, the Frontier Model Forum (FMF) has released a new Jailbreak Rating Framework that aims to track how easy it might be for a given AI model to get around safeguards. The framework also estimates the scale of the collateral damage, should an AI model wreak cyber-havoc across the internet.

The project started in 2023 with the support of four founding companies: Anthropic, Google, Microsoft, and OpenAI. The published Jailbreak Rating Framework is a rough analog to the well-known CVSS security rating system, but specifically targeted at classifying the type and severity of LLM jailbreaks across various axes and multiple frontier LLM providers.

Many AI companies and evaluation entities already have their own rating systems, but the FMF intends for its scale to be a cross-vendor standard that teams developing patches can rely on.

The FMF's approach is to have a classification method for jailbreaks that can make a model perform cyber-warfare operations beyond what's already out, across both the regular and black market. Version 1.0 of the proposal is a work-in-progress, and the group is taking comments and suggestions on it until December 21, noting that relying on its system in the meantime is inadvisable.

Right now, the framework has four scoring components, split across two main categories: severity, measuring how serious a jailbreak technique is, and likelihood, or how easy it is to find and weaponize it.

A combined final rating adds the scores obtained from the two categories into a final low-to-critical rating. The scientists note that the capability gain is the most important dimension and acts as both a floor and a ceiling for the remaining scores — a jailbreak that doesn't offer results beyond what can already be obtained via other means is meaningless within the purview of the grading system.

The individual ratings pertain to capability gains, capability scope, ease of deployment, and ease of discovery. They're all graded from zero to three, though the FMF stresses that a rating of zero doesn't mean a jailbreak is harmless or ought to be ignored — rather, it means the flaw should be addressed by standard practices like the platform's policies and standard cybersecurity ratings.

An important feature is that the FMF's baseline implicitly changes as models evolve, meaning that a grade of zero for a jailbreak in 2026 likely isn't going to mean the same thing as it would in 2028, or isn't better than alternative tools. A capability-gain rating of zero means that the jailbreak under analysis doesn't offer any improvement beyond what can already be done with existing models or tooling right off the bat.

For example, jailbreaking a model to perform a DDoS on a site isn't all that helpful to an attacker, since there are a number of black-market sites for that — or even other LLMs with fewer safeguards. This doesn't mean the jailbreak isn't handy, only that it's no better than the alternatives. However, the rating can be higher if the attacker can leverage the jailbreak to get a better DDoS than they could otherwise shop for.

On the other end of the capability-gain scale, three means that a jailbroken model can perform cyber-attacks with capabilities similar to those of a model operating without safeguards.

The capability scope measurement is easier to interpret: zero means that the jailbreak only works for one specific action or target and can't be tweaked for other applications, or in other words, is a one-trick pony. A jailbreak gets a rating of three when it can, without specific redesign, make a model perform work across at least two entirely unrelated categories of cyber-warfare — like getting the model to both autonomously discover vulnerabilities or, separately, write malware.

For ease of deployment, the FMF considers the amount of human interaction, or the degree of automation that the jailbreak allows. A zero means that the jailbreak must be steered by humans with a high degree of knowledge, providing additional instructions to be effective, while a three means that, with little effort, it can be used by a novice and results in an automated cyber-warfare task.

Last but by no means least, ease-of-discovery is how hard it is to find the jailbreak. At a zero, the attacker must spend copious amounts of money on inference tokens, need elevated access (like a privileged account given to a white-hat hacker), or specialized infrastructure like a legion of AI servers. A rating of three simply means that anyone can look up the technique and use it.

If all of this sounds familiar, you may be thinking of Anthropic's safeguard-breakage classifiers the company proposed in July 2026, after an incident that led to Claude Fable 5 being temporarily unavailable. Much like the FMF's effort, Anthropic's system would also use a moving baseline and only consider jailbreaks that improve on cyber-warfare capabilities already available.

That document is strikingly similar to FMF's proposal. Anthropic is an FMF founding member, and as such may have had a hand or two in developing the new standard — though we have no confirmation either way.