The Frontier Model Forum released version 1.0 of a framework on 5 November 2026 to rate successful jailbreaks against frontier AI models, backed by Amazon Web Services, Anthropic, Google DeepMind, Microsoft and OpenAI.

The framework scores each reproducible jailbreak from 0 to 3 across four categories: capability gain and capability scope assess severity, while ease of deployment and ease of discovery assess likelihood.

A jailbreak is rated Negligible if it offers no meaningful capability improvement over the most capable widely available models; otherwise, severity and likelihood are combined to assign Low, Medium, High or Critical, with capability gain also constraining the final band.

The article’s calculations identify 256 possible score combinations, including 64 that fall at the Negligible gate; before capability-gain adjustments, the remaining combinations map to 15 Low, 81 Medium, 81 High and 15 Critical outcomes.

Ratings are relative to the most capable widely available models at the time of assessment—currently October 2026—so the same jailbreak could be rated differently as models improve; ExploitBench and ExploitGym are named as possible initial screening tools.

OpenAI posted its support on X on 6 November, with its Head of National Security Policy, Sasha Baker, calling the framework a step toward a shared way to compare jailbreak severity; executives from the other four backing companies also endorsed it.

The framework is preliminary and intended to prompt discussion, not serve as operational guidance; it still needs testing for consistency across assessors and measures relative rather than absolute risk.

A risk band does not prescribe remediation, which remains each company’s responsibility, and the forum invited public comments on the framework’s dimensions, tiers and thresholds through 21 December 2026; feedback from experts at NIST CAISSI, NSA SISC, UK AISI and UK NCSC does not imply their endorsement.