Frontier Model Forum drops v1.0 of its AI jailbreak report card

The Frontier Model Forum has a new rulebook for an old headache: people coaxing frontier AI models into helping with cyberattacks. The group published Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats on Nov. 5, 2026. The FMF calls it a preliminary framework — a polite way of saying the scoring rules are still up for edits.

A jailbreak, in plain terms, is any trick that gets a model to ditch its safety guardrails and do something it was built to refuse. The framework grades each technique on four inputs: capability gain, capability scope, ease of deployment and ease of discovery. Those feed a scoring system that maps onto two axes — Severity and Likelihood — producing an overall risk class that climbs from Negligible to Critical.

The point is triage. A jailbreak that's hard to find, hard to pull off and barely unlocks anything new sits low on the scale. One that's easy to stumble across and hands over serious offensive firepower gets flagged for urgent attention. The FMF says the goal is a shared understanding of cyber-related jailbreaks, aimed at AI developers, security researchers and policymakers all trying to read the same threat landscape.

The framework was built by FMF members leaning on their own internal security teams, with the AI Security Institute also chipping in during development. OpenAI and other Forum members pitched it as a tool for rating cyber jailbreak risk and prioritizing stronger safeguards, and AISI experts have endorsed it as a meaningful contribution to technical best practices. The FMF itself dates back to July 2023 and counts Amazon, Anthropic, Google, Meta, Microsoft and OpenAI among its members.

This lands on top of earlier FMF work, including a February 2026 information-sharing agreement on threats and vulnerabilities. That deal was about passing intelligence between labs; the new framework tackles the follow-up question — once a threat is spotted, how worried should everyone be? Before a common scale existed, one lab's 'serious' jailbreak could be another lab's minor one, which made cross-industry comparisons a mess.

For researchers, the payoff is more consistent disclosures — a report can be framed using the same four categories a lab will use to judge it. For policymakers, it's legibility: a published methodology with defined categories and risk bands gives them something concrete to poke at. The FMF has said it will update the framework iteratively based on public comments, and that comment period runs until Dec. 21, 2026.