The Frontier Model Forum has released Version 1.0 of its Jailbreak Rating Framework for Frontier Cyber Threats, a preliminary method for scoring how serious a successful cyber-related jailbreak is compared with others. The FMF’s 5 November 2026 update presents the framework as a shared industry tool for developers, security researchers and policymakers — not as a statute, licence condition or government certification that every safeguard has been tested.
The problem FMF names is comparison. Without a common rating method, the same bypass can be treated as urgent by one lab and as a low-priority curiosity by another, while scarce patching time goes to noisier issues first.
Four dimensions, not a single pass/fail badge
Version 1.0 uses a tiered assessment that combines scores across four categories FMF lists as capability gain, capability scope, ease of deployment and ease of discovery. In plain terms, assessors look at how much extra cyber ability a bypass unlocks, how wide that ability stretches, how readily it can be put to use, and how easy the technique is to find. The framework is meant to sort jailbreaks by the capabilities they unlock and how usable those capabilities are, so teams can prioritise higher-risk failures.
FMF is explicit that Version 1.0 is an initial release. It says it will keep testing whether different assessors reach similar ratings and whether those ratings track meaningful risk differences, and that it will update the document as techniques and evidence evolve. Public comment runs through 21 December 2026 to the address on the FMF page. TSN is not submitting comments on readers’ behalf.
Supporting statements on the FMF page come from Amazon Web Services, Anthropic, Google DeepMind, Microsoft and OpenAI. That is industry endorsement of a shared method, not a regulator’s approval stamp.
OpenAI’s post and the limits of “common methodology”
OpenAI’s verified account posted on 6 November 2026 that it had partnered with FMF and member firms on a framework to help identify when bypassing safeguards could enable serious cyber harm and to prioritise stronger protections. The post quotes OpenAI’s Sasha Baker, Head of National Security Policy, calling the framework “an important step toward a common methodology for evaluating and comparing the severity of cyber jailbreaks, including the capabilities they unlock and how readily they can be used,” and saying shared approaches can help build a clearer evidence base for safeguard improvements. That wording matches Baker’s quote on the FMF page; the X post is the public credit channel OpenAI used the next day.
None of that language turns the framework into law, a mandatory audit, or proof that member models have cleared every cyber jailbreak class.
How this sits next to TSN’s jailbreak and cyber-model posts
TSN already covers comparative safety scoring in MLCommons’ AILuminate jailbreak results across 27 systems — a benchmark-style ranking rather than FMF’s four-axis severity framework for successful cyber bypasses. On the defensive-capability product side, OpenAI’s GPT-6 Cyber launch for defensive research is the nearest model-story neighbour: more cyber ability in a marketed system raises the same question FMF is trying to score when safeguards fail. OpenAI’s activation-probe safety monitoring is a different safeguard layer again — runtime watching rather than a post-hoc jailbreak severity scale. FMF sits with the evaluation and AI-regulation hub file: shared methodology first, enforcement nowhere in these sources.
Shared ratings are not a regulator’s seal
For policy and security readers, the useful distinction is between interoperability of judgement and legal force. A voluntary four-dimension score can help two labs argue about the same bypass in the same vocabulary. It cannot, on this record, certify that a model is safe to deploy, bind a non-member, or replace national critical-infrastructure rules. Ease of discovery and ease of deployment scores also say nothing useful if published as recipes; FMF’s public note stays at the rating method, and so does this article.
Member quotes from AWS, Anthropic, Google DeepMind, Microsoft and OpenAI show industry appetite for comparable severity language. They still leave Version 1.0 as FMF describes it: preliminary, open to revision after the 21 December 2026 comment window, and dependent on further testing of whether assessors agree. Country tagging is global: FMF is a cross-company forum, and the release does not hinge on a single national capital. UK readers get a comment window to 21 December 2026 if they want to feed the next revision — still a voluntary industry process, not an FCA or DSIT rulemaking.
What to watch next
Three public breadcrumbs would harden the file: FMF publishing inter-rater reliability results from its promised testing; a Version 1.1 that incorporates the December comment round; or a government or standards body citing the four dimensions in official guidance. Until then, FMF jailbreak Version 1.0 is a voluntary frontier-cyber rating method with an open comment deadline of 21 December 2026 — useful for prioritising which bypasses matter most, not a legal seal.
Sources
Primary:
- Frontier Model Forum: Jailbreak Rating Framework for Frontier Cyber Threats v1.0 (5 Nov 2026)
- OpenAI on X: FMF jailbreak framework partnership (6 Nov 2026)
Related stories
MLCommons Ranks 27 AI Systems on Safety; Open Models Span 4th to Last on Jailbreaks is the closest TSN neighbour for readers comparing evaluation frameworks. Also relevant: OpenAI Launches GPT-6 Cyber for Defensive Research and OpenAI Says Activation Probes Now Watch Its Models as They Answer.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
