The Frontier Model Forum released a proposed method on November 5, 2026, for judging whether an AI safety bypass represents a minor failure or a serious cybersecurity threat. Its Jailbreak Rating Framework for Frontier Cyber Threats assigns four separate scores, then groups findings into five risk bands. The new scale responds to a growing problem: successful AI jailbreaks vary enormously in what they enable, but researchers lack a shared way to compare them.

A jailbreak is a reproducible prompt or procedure that defeats an AI model’s intended safeguards. A response that offers basic information already publicly available is not equivalent to reliably unlocking advanced offensive capabilities. The framework evaluates a particular bypass against a specified model version, rather than grading an entire AI service.

Google Cloud Tech’s October 30, 2025 Model Armor demonstration shows a separate real-world approach to filtering jailbreak prompts. Background illustration only; not footage of the Forum’s announcement. Source: Google Cloud Tech / YouTube.

Four questions determine the score

The Forum’s Version 1.0 specification identifies capability gain, capability scope, ease of deployment and ease of discovery. Each dimension receives an ordinal rating from 0 to 3. Capability gain asks how far the bypass exceeds widely available AI systems. Scope asks whether the technique generalizes across tasks. Deployment measures how readily a user can repeat it. Discovery captures how hard the technique is to find.

The first two dimensions describe severity; the latter two address practical likelihood. For example, a brittle trick that works on one question differs from a repeatable technique that transfers across categories. The numerical tiers represent qualitative steps in concern, not percentages or measured chances that an attack will occur.

From four scores to five provisional risk bands

Capability gain provides the initial gate: a score of zero yields a Negligible frontier-risk rating under the proposal. Otherwise, severity equals capability gain plus capability scope, and likelihood equals deployment ease plus discovery ease. The two totals intersect in a matrix spanning Low, Medium, High and Critical as well as Negligible. Additional capability-gain limits can raise or cap the resulting band.

A lower frontier-risk rating does not declare an action harmless. Ordinary cybersecurity rules and platform safety controls still apply. Nor should the framework be confused with the Common Vulnerability Scoring System: CVSS evaluates software vulnerability severity, whereas the Forum’s proposal compares the incremental offensive capabilities unlocked by model safeguard bypasses.

Why cyber defenders want a common yardstick

AI models increasingly help authorized security teams investigate software defects, while similar techniques can potentially assist attackers. Earlier BitcoinVersus.Tech reporting on GPT-6 Cyber documented advanced vulnerability research claims and associated evaluation questions. Separate Microsoft threat research described AI-assisted credential theft, illustrating why practical access and execution conditions matter alongside model capability.

Google DeepMind’s October 13, 2026 video presents Gemini 4 Argon in defensive cyber research. It provides broader context on AI security capability, not a demonstration or endorsement of the Forum’s November rating framework. Source: Google DeepMind / YouTube.

A shared vocabulary could help model providers decide which discovered failures merit investigation first, compare red-team findings across organizations and explain urgency to policymakers. The approach complements work on emerging AI security incidents and monitoring unpredictable agents; it does not replace access controls, logging, independent testing or software patching.

An open draft, not a certified security standard

The Forum explicitly describes Version 1.0 as preliminary. The published score has not yet been validated by showing independent assessors consistently assign comparable ratings. Evaluations also depend on the reference baseline: the best widely available cyber-capable models as of October 2026. As public models improve, an unchanged jailbreak may qualify for a lower capability-gain tier.

The organization plans further testing and is accepting written feedback through December 21, 2026. Its acknowledgments include input from national security and AI safety specialists, without treating consultation as formal endorsement. The immediate development is a proposed measurement language—not proof that any particular model has become safe, that attacks have become less common, or that a new benchmark has measured real-world losses.

Sources and Editor’s Note

Editor’s Note: Primary reporting is based on the Frontier Model Forum’s November 5, 2026 announcement and full HTML specification. Scores and labels shown in the graphics reproduce the proposed framework, not observed incident counts. The five risk bands remain provisional and subject to capability-gain guardrails. The two earlier official YouTube videos provide related security context and do not depict the November 5 announcement. The cover is original conceptual artwork, not a photograph of a specific intrusion. Live player rendering and playback require independent checks.

Support independent technology reporting

Readers who wish to contribute 5,000 satoshis can scan the original BitcoinVersus.Tech donation QR with a compatible Bitcoin wallet. On a single phone, display the QR on another screen or use the wallet’s supported saved-image scanner. Check the recipient and payment amount before sending.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.