What happened
The Frontier Model Forum (FMF) says it is releasing version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats on November 5, 2026. The framework is a preliminary method for rating the comparative risk profile of successful cyber jailbreaks. FMF describes a jailbreak as a reproducible technique that unlocks capabilities or information a model’s safeguards are meant to restrict. Its stated purpose is to help AI developers, security researchers, and policymakers interpret and respond to emerging AI-related cyber threats.
The method combines scores across four categories: capability gain, capability scope, ease of deployment, and ease of discovery. In FMF’s description, the framework categorizes jailbreaks by the capabilities they unlock and how readily those capabilities can be used. The distinction matters because a successful bypass may yield responses of limited practical use, while another may give malicious actors access to dangerous cyber capabilities. The framework is intended to make assessments more comparable and help organizations prioritize work rather than treating every successful bypass as equivalent.
The announcement includes support from representatives of Amazon Web Services, Anthropic, Google DeepMind, Microsoft, and OpenAI. FMF says member-company security experts contributed to development. Those statements establish institutional backing, but they do not themselves demonstrate that the scoring produces consistent or predictive risk assessments.
FMF calls version 1.0 an initial release. It says it will test the framework against a range of jailbreaks to determine whether different assessors reach similar ratings and whether those ratings reflect meaningful differences in risk. The organization says it will update the framework as new jailbreaks are discovered, techniques evolve, and empirical understanding improves. A public comment period is open through December 21, 2026, with feedback invited by email to comments@frontiermodelforum.org. FMF says it will review feedback with its members and incorporate relevant input into an updated version.
What the archive adds
New Runtime’s earlier coverage has tracked jailbreak evaluation from two angles: Check Point Research’s report on Haiou jailbreak bundles described configuration changes that inject persistent ads into Codex instructions, while JailBound’s evaluation framework reported results across 46 LLMs. FMF’s release is a new fact on this broader topic: a cross-industry rubric for comparing cyber jailbreak severity, not another individual attack or model benchmark.
Trend signal
This supports the broad direction of assessing agent and model risk at operational boundaries, but it does not directly establish a pattern New Runtime tracks. The framework is a proposed rating method, not evidence that runtime controls or harness designs have changed. This does not yet fit a pattern New Runtime tracks.
Why now
FMF says frontier models’ growing cyber capabilities can help defenders find vulnerabilities but may also be used for malicious activity. It presents the framework as a response to organizations assessing the same jailbreak differently and potentially spending limited resources on lower-risk issues before higher-risk threats. The public comment period through December 21, 2026 gives external experts a defined window to influence the initial method.
Why it matters
For teams building or deploying AI systems with cyber capabilities, the useful claim is not that a shared scale automatically makes models safer. It is that triage could become more legible: security teams can discuss what a bypass unlocks, how broad the capability is, and how difficult it is to deploy or discover, rather than reducing the finding to “jailbreak succeeded.” That may help allocate scarce red-team and mitigation capacity toward failures with greater practical consequence.
The framework also creates a potential coordination surface between model developers and independent security researchers. If different organizations can apply the categories consistently, findings may be easier to compare and escalate. Until that consistency is demonstrated, teams should treat the rubric as a candidate vocabulary for internal review, not as a validated severity benchmark or a substitute for testing the actual system, tools, and permissions exposed to a model.
What happens next
- FMF will publish an updated framework incorporating at least some public feedback (3 months, 65%). Watch for: a revised version or explicit summary of accepted feedback before February 2027.
- FMF will report whether independent assessors produce similar ratings in its tests (6 months, 55%). Watch for: a validation report with assessor agreement results and examples across jailbreaks.
Limits and uncertainty
FMF describes version 1.0 as preliminary and says validation is still ahead. The announcement does not report inter-assessor agreement, empirical correlation between ratings and real-world harm, or evidence that use of the framework improves mitigation outcomes. It also does not establish adoption outside participating organizations. The named companies’ support and contributions are relevant, but are not independent validation. The scoring’s practical value will depend on how clearly categories can be applied to varied systems and how the framework handles uncertainty in a finding.
Skill to build now
For your next internal red-team review, record a successful cyber bypass against the four dimensions FMF names: what capability it adds, how wide that capability is, how easy the bypass is to deploy, and how easy it is to discover. Keep the observed behavior and test conditions alongside the rating. This gives reviewers a structured comparison without assuming the preliminary framework is already validated.
Reader takeaway
FMF’s new framework offers a shared way to describe why one successful cyber jailbreak may matter more than another. Its four dimensions could improve triage, but version 1.0 is still being tested; teams should treat it as a provisional rubric until assessor consistency and real-world usefulness are demonstrated.
Open question
Will independent assessors using the four categories converge on similar ratings for the same cyber jailbreaks?