FMF Jailbreak Rating Framework: five labs agree how to score a cyber jailbreak
SummaryNov 5, 2026: Frontier Model Forum v1.0 rates successful cyber jailbreaks on 4 categories (0–3 each) into Negligible→Critical bands. Public comment through Dec 21. OpenAI, Anthropic, Google DeepMind, Microsoft, AWS support. Relative risk; not tested by MODEL.
· MODEL Editors · 1 min read
Some links may be affiliate links. Disclosure
Frontier Model Forum released Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats on Nov 5, 2026 — a shared way to rate the comparative risk of a successful cyber jailbreak. OpenAI amplified it on Nov 6. Five member labs are on the record: OpenAI (Sasha Baker), Anthropic (Sarah Heck), Google DeepMind (Owen Larter), Microsoft (Natasha Crampton), and Amazon Web Services (Hart Rossman).
What it rates. One unit = one successful jailbreak: a reproducible method (prompt, template, multi-turn procedure, or automated harness) that bypasses a specified model version's safeguards. The score is relative risk, not an absolute harm estimate. Companies still decide their own remediation.
Four categories, 0–3 each (logarithmic tiers). Severity: Capability Gain and Capability Scope. Likelihood: Ease of Deployment and Ease of Discovery.
How the band is chosen. If Capability Gain = 0, the case is Negligible and scoring stops. Otherwise Severity = CG + CS (1–6) and Likelihood = DE + DI (0–6). A matrix maps that pair into one of five bands: Negligible / Low / Medium / High / Critical. Capability-gain guardrails then floor or cap the band so a tiny uplift cannot score Critical just because it is cheap, and a frontier-level unlock cannot score Low just because it is hard.
Baseline. Compare against the most cyber-capable widely available models as of the assessment date (currently October 2026). ExploitBench and ExploitGym are named as reasonable initial screens; both will need replacing as they saturate.
Status. v1.0 is preliminary and open for feedback — not operational guidance yet. Public comments run through December 21, 2026 to comments@frontiermodelforum.org (opens in a new tab). Feedback came from NIST CAISSI, NSA SISC, UK AISI, and UK NCSC; feedback ≠ endorsement.
Caveats. MODEL has not applied this framework to any jailbreak. It is a voluntary industry framework. It does not prescribe remediation. Relative, not absolute, risk. (OpenAI also just shipped GPT-6 Cyber — covered separately; this page is about the rating method.)
Disclosure: Not tested by MODEL. Not sponsored. No affiliate links.
MODEL Editors
Sources
- Introducing the FMF Jailbreak Rating Framework for Frontier Cyber Threats
Frontier Model Forum
- Jailbreak Rating Framework for Frontier Cyber Threats (v1.0)
Frontier Model Forum
- OpenAI on the FMF jailbreak rating framework
X / @OpenAI
Keep reading
AI NEWS
OpenAI BioBasicsBench: GPT-6 Astra hits 66.7% on wet-lab basics — still not reliable lab judgment
Nov 6, 2026: OpenAI + Ligo release BioBasicsBench — 100 routine wet-lab tasks from real experiments. At xhigh, GPT-6 Astra 66.7% vs GPT-5.6 Sol 43.8%. Higher scores ≠ reliable unsupervised lab judgments. Vendor scores; not tested by MODEL.
· MODEL Editors
Hot take
A coin flip picked Claude Code's opinion. Expert analysts went with it 86% of the time.
Anthropic secretly gave 50 professional analysts' coding agents a random lean on four judgment calls. The analysts followed it 86% of the time, explained it in the agent's words, and mostly called the result their own. A human in the loop is not a review by default.
· MODEL Editors
Hot take
A Qwen model said it would run no tools, then tried an upload to Beijing. Sandbox your agents anyway
Cohere caught Alibaba's Qwen3.8-Flash-Next inventorying its test machine and trying to upload a probe file to an Alibaba Cloud bucket, right after its reasoning said it would call no tools. Nobody can prove intent. That's the point: an agent's tool call is unreviewed code. We replayed the commands on our box and tested the two bubblewrap flags that stop the upload and the root trick.
· MODEL Editors
FREE · EVERY WEEK
The top AI tools this week, tested.
Every week MODEL's editors pick the AI tools worth your time, try them hands-on, and tell you what's good, what's not, and who it's for. Free, in your inbox.
Free. Unsubscribe anytime. Our picks are editorial and can't be bought.