A jailbreak is a reproducible way around a model's guardrails — a prompt, a template, a multi-turn conversation, or an automated harness that gets the model to hand over capabilities or information its safeguards were meant to withhold. Some of them are party tricks: they produce answers of limited practical use. Others could hand a malicious actor genuinely dangerous cyber capability. Until now, there was no agreed way to tell the two apart.

That gap is what the Frontier Model Forum's new framework is built to close. The forum, an industry body whose members include OpenAI, Anthropic, Google DeepMind, Microsoft and Amazon, released version 1.0 on November 5. The idea is simple enough to state and hard enough to execute: give every successful jailbreak a comparable rating, so security teams can triage consistently, researchers can compare findings across companies, and the highest-risk bypasses get fixed first.

What the framework actually scores#

The unit being rated is one successful jailbreak against one specific model version, safeguards included. The framework deliberately does not rate models as a whole, and it does not rate failed attempts. The question it answers is narrow: this bypass worked — how much does it matter?

Security leads from all five member companies endorsed the release; the forum says the framework was drawn up by security experts across those companies. That matters, because a rating only works if the people who must act on it trust it.

Five pillars of light in different colors rising over a city skyline at dusk, connected by network lines
AI-generated illustration: five labs, one shared standard.

Four scores, five bands#

Each jailbreak is scored on four dimensions, each on a four-tier scale from 0 to 3, with the tiers designed to be roughly logarithmic — each step up is several times more serious than the last.

DimensionWhat it measures
Capability gainThe offensive cyber ability the jailbreak unlocks, compared with what widely available models can already do
Capability scopeHow broadly the unlocked ability generalizes
Ease of deploymentHow readily an attacker can actually use it
Ease of discoveryHow hard the bypass is to find in the first place

The first two combine into a severity axis; the last two into a likelihood axis. Where the two axes meet, the jailbreak lands in one of five bands: Negligible, Low, Medium, High, or Critical. One hard rule: a capability-gain score of zero ends the assessment at Negligible, whatever the other scores say — a bypass that unlocks nothing new is not a risk, however easy it is to run.

The baseline matters as much as the scores. Capability gain is measured against the most cyber-capable widely available models on the assessment date — currently October 2026 — and the framework names ExploitBench and ExploitGym as reasonable first screens for that comparison. As models improve, the baseline moves with them, which means a jailbreak rated High today could rate lower in a year if the capability it unlocks becomes ordinary.

A security analyst studying a large wall display with a color-coded risk gauge from green to red
AI-generated illustration: a shared rating turns triage into a repeatable decision.

Why now: cyber went frontier this week#

The timing is not a coincidence. The framework landed in the same week the frontier labs shipped their most cyber-capable models yet. OpenAI released GPT-6 Cyber, which it rated Critical under its own preparedness framework after the model scored 48.5% on ExploitGym — and Google DeepMind shipped Gemini 4 Carbon, a model built for cyber defense that almost nobody can use yet. The same capabilities that let a model find vulnerabilities and secure systems can be turned around by an attacker. The forum's argument is that the industry needs a shared language for that risk before the models get more capable, not after.

There is also a defensive logic: a common scale gives security teams consistent labels for triage, disclosure and remediation, and researchers a shared vocabulary for comparing findings. The alternative — every lab grading bypasses on its own scale — is the world the framework is trying to leave behind.

What it does not do — yet#

Version 1.0 is explicitly preliminary. The forum says the tiers and thresholds are a starting point for discussion rather than guidance to apply operationally, and it plans to test the framework against a range of real jailbreaks to see whether different assessors reach similar ratings — and whether those ratings track meaningful differences in risk. A rating system that two experts read differently is not a standard yet.

It is also voluntary — an industry agreement, not a regulation, with no enforcement mechanism. Its authority depends entirely on whether researchers, labs and policymakers actually use it, in disclosures and in internal triage.

The forum has opened a public comment period through December 21, 2026, inviting outside experts and organizations to send feedback before it revises the framework with its members.

What to watch#

  • Whether independent researchers adopt the scale in public jailbreak disclosures, or keep using their own language.
  • Whether assessors converge: the forum's own testing will show if two experts grading the same bypass land on the same band.
  • What changes after December 21, when the comment period closes and the framework is revised.
  • Whether the October 2026 baseline gets updated — and how ratings shift when it does.
  • Whether regulators or standards bodies pick the framework up, which would turn a voluntary industry scale into something closer to a requirement.

Sources: Frontier Model Forum; FourWeekMBA; AlphaSignal