THE ESSENTIALS IN 30 SECONDS

  • Published November 5, the preliminary framework rates a single successful jailbreak on capability gain, capability scope, ease of deployment and ease of discovery, each scored 0 to 3.
  • Scores combine into severity and likelihood axes, which map to bands from Negligible to Critical; a jailbreak with no meaningful capability gain stops at Negligible.
  • The Forum says consistency between assessors is not yet established and is taking comments at comments@frontiermodelforum.org until December 21, 2026.

The Frontier Model Forum (FMF), the industry group whose members include Amazon, Anthropic, Google DeepMind, Microsoft and OpenAI, released version 1.0 of a framework for rating jailbreaks that bear on frontier cyber threats on November 5. A jailbreak, in the Forum's definition, is a reproducible method that bypasses the safeguards of a specific model version to unlock restricted capabilities. The stated goal is that different organizations stop rating the same jailbreak differently, can compare findings and can put the riskiest cases first.

Four dimensions, two axes

Each jailbreak is scored from 0 to 3 on four dimensions. Capability gain measures what it unlocks compared with the most cyber-capable widely available models, the baseline at the time of assessment. Capability scope looks at how far it generalizes, from a single unreliable case up to a "universal" technique that works across unrelated risk categories. Ease of deployment covers how much skill and manual effort it takes to turn into a working attack, and ease of discovery estimates the resources needed to find it, from very large inference budgets or privileged model access down to public proof-of-concept code.

The first two scores add up to a severity axis and the last two to a likelihood axis. A risk matrix then assigns a band: Low, Medium, High or Critical. Capability gain acts as a gate and a guardrail: a score of zero ends the assessment at Negligible, minimal gain cannot reach High however easy the attack, and frontier-level gain cannot be rated Low. The specification names ExploitBench and ExploitGym as initial screening benchmarks, and expects them to be replaced as they saturate, so the same jailbreak may be rated differently over time.

What it does not do

The FMF stresses that the scores are relative. They do not estimate real-world harm or the overall risk of a deployed system, which depends on other defenses, and the resulting band does not dictate a response; remediation stays with each company. Cases below the frontier bar are left to conventional tools such as usage policies.

The document calls its tiers and thresholds preliminary and says it has not yet shown that different assessors reach similar ratings. The Forum plans further testing against a range of jailbreak examples and will revise the framework as techniques change. Public comments can be sent to comments@frontiermodelforum.org until December 21, 2026, after which the FMF says it will review them with its members for an updated version.