The Frontier Model Forum (FMF) has released Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats, a preliminary proposal for comparing the relative risk of successful cyber jailbreaks. The announcement and specification are dated November 5, 2026, with public feedback open through December 21, 2026.

The proposal addresses a practical problem: two findings may both show a model’s safeguards being bypassed, yet differ substantially in what they enable. FMF aims to give developers, researchers and policymakers a shared vocabulary for discussing those differences. Its assessment unit is an individual, reproducible jailbreak that has succeeded against a specified model version.

Four dimensions of relative risk

  • Capability gain: how much additional cyber capability the finding unlocks compared with widely available capabilities at the time of assessment.
  • Capability scope: how broadly that capability extends across cyber-risk areas.
  • Ease of deployment: how much effort and expertise are needed to put the unlocked capability to use.
  • Ease of discovery: how accessible the finding is, considering the resources needed to discover it.

The framework combines severity and likelihood into five bands: Negligible, Low, Medium, High and Critical. These bands describe a finding’s comparative significance. Decisions about remediation remain with organizations, alongside their wider safety and security practices.

A proposal that still needs testing

FMF plans to test whether different assessors give similar ratings and whether those ratings capture meaningful differences in risk. The proposed dimensions, tiers and thresholds remain open to revision before operational reliance.

The reference baseline also changes as capable models become widely available, so an unchanged finding can receive a different rating over time. Findings below the frontier-risk threshold still belong within conventional risk management. System-level risk judgments additionally depend on other defenses and the environment in which a model is used.

We haven’t applied the framework to cases or independently tested how consistently it produces ratings.