Frontier Model Forum publishes shared framework to rate AI jailbreak risks

The Frontier Model Forum published a shared method for rating successful cyber jailbreaks on November 5, 2026, aiming to help security teams decide which AI safeguard failures deserve attention first. Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats is preliminary, with public feedback open through December 21.

The release includes statements of support from OpenAI, Anthropic, Google DeepMind, Microsoft and Amazon Web Services. Google DeepMind and AWS explicitly said they contributed to its development. The forum presents the framework as a way for developers, security researchers and policymakers to interpret emerging AI-related cyber threats using a common approach.

A jailbreak is a reproducible technique that bypasses safeguards to unlock capabilities or information those safeguards are meant to restrict. The forum draws an important distinction: a successful bypass can produce an answer with little practical use, or it can give an attacker access to dangerous cyber capabilities. Success alone does not describe the risk.

Four inputs, rather than a pass-or-fail label

The framework combines scores across four categories in a tiered assessment. Its focus is both the capabilities a jailbreak unlocks and how readily those capabilities can be used. That makes the assessment about the consequences and accessibility of a bypass, rather than merely recording that a model’s controls were defeated.

The four scoring categories

• Capability gain
• Capability scope
• Ease of deployment
• Ease of discovery

The operational problem, according to the forum, is that organizations can assess the same jailbreak differently. Without a common method, comparing findings becomes harder, and teams may spend limited resources fixing lower-risk issues before addressing more serious threats. The framework is intended to make findings comparable and help organizations prioritize mitigation by potential risk.

The growing cyber capabilities of frontier AI models call for shared approaches to assessing and managing emerging risks. Not all successful jailbreaks pose the same level of risk.

Natasha Crampton, Microsoft vice president and chief responsible AI officer

The ratings still need to prove useful

The forum’s rationale reflects the dual use of cyber-capable AI. Models that help defenders find vulnerabilities and secure systems may also help attackers conduct malicious activity. Understanding the danger therefore requires examining both whether safeguards can be bypassed and what those failures could enable. The new framework addresses the comparative risk of successful jailbreaks within that problem.

Version 1.0 is an initial release, not the end of that work. The forum says it will continue testing the framework against a range of jailbreaks. Two questions will guide that testing: whether different assessors reach similar ratings, and whether those ratings capture meaningful differences in risk. Consistency and usefulness are both still being evaluated.

The method is also meant to change as the underlying threats change. The forum plans to update it when researchers discover new jailbreaks, existing techniques evolve and empirical understanding improves. Google DeepMind’s contribution statement similarly describes the release as an initial version and calls for continued work with industry, researchers and government on best practices.

External experts and organizations can submit public comments through December 21, 2026, at comments@frontiermodelforum.org. The forum says it will review feedback in consultation with its members and incorporate relevant input into an updated version. That consultation gives people outside the contributing companies a route to challenge or improve the method before its next revision.