# Frontier Model Forum: a shared scale for rating cyber jailbreaks

> The FMF Jailbreak Rating Framework scores a cyber jailbreak on capability gain, capability scope, ease of deployment and ease of discovery.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Lab safety
- **Published by:** Frontier Model Forum
- **Disclosed:** 2026-11-05
- **Affects:** Frontier AI models
- **Research by:** [Frontier Model Forum](https://www.frontiermodelforum.org/)
- **Primary source:** https://www.frontiermodelforum.org/updates/introducing-the-fmf-jailbreak-rating-framework-for-frontier-cyber-threats/
- **Page:** https://theinjection.dev/items/fmf-jailbreak-rating-framework/

The Frontier Model Forum published version 1.0 of a framework that rates a cyber jailbreak on four 0 to 3 scores and maps them onto five risk bands, from Negligible to Critical. Comments are open until December 21, 2026.

## What happened

The Frontier Model Forum released version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats on November 5, 2026, and opened a public comment period that runs to December 21, 2026. The FMF presents it as a preliminary, structured method for rating the comparative risk of reproducible jailbreaks that get past AI safeguards to unlock restricted cyber capabilities. Its acknowledgements thank experts from NIST CAISSI, NSA SISC, UK AISI and UK NCSC for feedback, and state that this does not imply endorsement.

## How it works

Capability gain and capability scope each score 0 to 3 and add up to a severity score; ease of deployment and ease of discovery do the same for a likelihood score. A capability gain of 0 ends the assessment at Negligible. The two sums are read off a published risk matrix to give a provisional band, which capability gain then caps or raises. Scope is measured in held-out items, so a jailbreak must unlock at least 5 of them to score above the narrow level.

## Who is affected

AI developers, security researchers and policymakers are the audiences the FMF names. Ratings are tied to one reproducible jailbreak against a specified model version, and the baseline is the most cyber-capable widely available models as of October 2026, so the same jailbreak can score differently once that baseline moves. The framework rates relative risk and does not estimate actual harm.

## What to do

Score jailbreak findings against the four published categories before deciding what to fix first, and record the model version and baseline used, since the FMF ties a rating to both. Comments on version 1.0 go to the address on the FMF announcement page until December 21, 2026.

## Quick facts

- **Version:** 1.0, preliminary
- **Scoring:** Four categories, each 0 to 3
- **Bands:** Negligible, Low, Medium, High, Critical
- **Baseline:** Most cyber-capable widely available models as of October 2026
- **Suggested screens:** ExploitBench and ExploitGym
- **Comments close:** 2026-12-21
- **Feedback from:** NIST CAISSI, NSA SISC, UK AISI and UK NCSC

## Questions

### How does the FMF framework turn four scores into one risk band?

The FMF framework adds capability gain and capability scope into a severity score of 1 to 6, then adds ease of deployment and ease of discovery into a likelihood score of 0 to 6. Those two sums are read off a published risk matrix to get a provisional band, which capability gain can then cap or raise. A capability gain of 0 stops scoring at Negligible.

### Which jailbreaks fall outside the FMF framework?

Jailbreaks that score 0 on a frontier-risk dimension sit below what the FMF calls the frontier bar, and the framework says traditional risk management covers those. The unit of assessment is one reproducible jailbreak against a specified model version, so a narrow or unreliable bypass that works on a single case scores 0 on capability scope. Harm estimation is out of scope.

### Is the FMF Jailbreak Rating Framework final?

Version 1.0 is preliminary and open for public comment until December 21, 2026. The FMF says it will test the framework against a range of jailbreaks to check whether different assessors reach similar ratings and whether those ratings reflect real differences in risk. The FMF also expects ExploitBench and ExploitGym to be replaced as they saturate.

## Sources

1. [FMF Announcement](https://www.frontiermodelforum.org/updates/introducing-the-fmf-jailbreak-rating-framework-for-frontier-cyber-threats/)
2. [Framework Spec](https://www.frontiermodelforum.org/specifications/jailbreak-rating-framework-for-frontier-cyber-threats/)