Frontier Model Forum Proposes a Four-Axis Scale for Rating AI Jailbreaks

Most jailbreak discussion still runs on anecdote. A researcher posts a prompt that gets a model to ignore its guardrails, the post spreads, and the vendor patches it, with little shared vocabulary for how bad the technique actually is. The Frontier Model Forum (FMF) wants to change that with its new Jailbreak Rating Framework, a draft scoring system that aims to measure how easy it is to get a model around its safeguards and how much damage a successful bypass could do in cyber operations.

Who is behind it and what it's modeled on

The project started in 2023 with four founding companies: Anthropic, Google, Microsoft, and OpenAI. The framework is explicitly modeled on the CVSS scoring system that security teams already use to rank software vulnerabilities. The analogy is useful but loose. CVSS was built for discrete flaws in fixed code. A jailbreak is a behavior that can shift with every model update, and the FMF's version has to account for that.

The group's pitch is cross-vendor consistency. Many AI companies and evaluation organizations already run internal rating schemes, and those don't map neatly onto one another. If the FMF's scale catches on, a patch team at one lab could read a jailbreak report from another and know roughly where it sits. That's the bet, anyway. The FMF is also clear that Version 1.0 is a work in progress, takes comments through December 21, and shouldn't be relied on in the meantime.

Severity and likelihood, combined

The framework splits its four scoring components across two categories. Severity covers how serious a technique is. Likelihood covers how easy it is to find and weaponize. Each component is scored from zero to three, and the two category scores combine into a final rating that runs from low to critical.

That split matters because it separates two questions that often get blurred. A technique can be trivially easy to find and still produce little that a bad actor couldn't already get elsewhere. Another can be devastating and nearly impossible to reproduce without privileged access. A single severity number would hide that difference. Two axes make it visible.

Capability gain is the gatekeeper

The researchers call capability gain the most important dimension, and they've given it an unusual role. It acts as both a floor and a ceiling for the other scores. If a jailbreak doesn't produce anything beyond what an attacker could already obtain, the framework treats it as largely beside the point, whatever its other properties.

Here's how that plays out. Suppose a jailbreak gets a model to run a DDoS attack against a website. That's not especially useful to an attacker, because DDoS-for-hire services already exist on black-market sites, and less-guarded models could do the same job. The jailbreak may still be handy, but it isn't better than the alternatives, so it scores zero on this axis. The picture changes if the jailbreak produces a more effective attack than an attacker could buy or build otherwise. At the top of the scale, a rating of three means a jailbroken model performs cyber-attacks with capabilities similar to those of a model with no safeguards at all.

The zero-to-three scale is relative, and that's deliberate. A rating of zero doesn't mean a flaw is harmless. The FMF says it should be handled through a platform's usual policies and standard cybersecurity practices. The baseline also shifts as models improve. A zero assigned today may not carry the same meaning in a later year, when the alternatives have changed.

Scope, deployment, and discovery

Capability scope is the most intuitive of the four. A zero means the jailbreak works for one specific action or target and can't be adapted without substantial rework, a true one-trick pony. A three means that without specific redesign, the technique can drive a model through at least two entirely unrelated categories of cyber operations. The example given is a single jailbreak that lets a model both autonomously find vulnerabilities and write malware.

Ease of deployment measures how much human skill and intervention the technique requires. A zero means a knowledgeable operator has to steer the model with ongoing instructions. A three means a novice can use it with little effort and get an automated task out of it. This axis tells you more about who could realistically use a technique than about what it can do.

Ease of discovery covers how hard it is to find the jailbreak in the first place. At zero, an attacker would need serious spending on inference tokens, elevated access of the kind a white-hat tester might hold, or specialized infrastructure such as a large cluster of AI servers. At three, anyone can look up the technique and run it. Discovery difficulty is the axis most likely to shift quickly, since a single shared write-up can move a technique from zero to three overnight.

A similar idea from Anthropic

Readers who followed earlier safeguard debates may recognize the approach. Anthropic has proposed its own framework for classifying safeguard-breaking techniques, published in July 2026 after an incident that left Claude Fable 5 temporarily unavailable. Like the FMF's draft, Anthropic's proposal uses a moving baseline and only counts jailbreaks that improve on cyber capabilities that already exist.

The two documents are strikingly close. Anthropic is one of the FMF's founding members, so it's plausible that its thinking shaped the shared standard. There's no public confirmation of that, and the overlap may simply reflect how many people are converging on the same problem. Either way, a common scale would matter more than any single author's version of it.

What to watch before adopting it

The FMF's own caveat is the right starting point. Version 1.0 shouldn't be treated as a production standard, and the comment period is the window for pressure-testing its definitions. The hardest parts will be the edges: deciding when a jailbreak's gain is "better than alternatives," and how to score a technique whose effectiveness depends on a model version that will be replaced within months.

The bigger question is whether labs, evaluators, and downstream deployers will score jailbreaks the same way once the document leaves draft form. If they do, a jailbreak report becomes something a patch team can act on without a translation step. If they don't, the framework adds one more rating system to the pile.