// TOM'S HARDWARE US — HARDWARE & GADGET
New framework grades AI jailbreaks across capability gains, scope, and how easy they are to deploy
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
In recent months, high-profile headlines about AI models letting loose from their safeguards dominated headlines. Now, the Frontier Model Forum (FMF) has released a new Jailbreak Rating Framework that aims to track how easy it might be for a given AI model to get around safeguards. The framework also estimates the scale of the collateral damage, should an AI model wreak cyber-havoc across the internet.
The project started in 2023 with the support of four founding companies: Anthropic, Google, Microsoft, and OpenAI. The published Jailbreak Rating Framework is a rough analog to the well-known CVSS security rating system, but specifically targeted at classifying the type and severity of LLM jailbreaks across various axes and multiple frontier LLM providers.
Many AI companies and evaluation entities already have their own rating systems, but the FMF intends for its scale to be a cross-vendor standard that teams developing patches can rely on.
The FMF's approach is to have a classification method for jailbreaks that can make a model perform cyber-warfare operations beyond what's already out, across both the regular and black market. Version 1.0 of the proposal is a work-in-progress, and the group is taking comments and suggestions on it until December 21, noting that relying on its system in the meantime is inadvisable.
Right now, the framework has four scoring components, split across two main categories: severity, measuring how serious a jailbreak technique is, and likelihood, or how easy it is to find and weaponize it.
A combined final rating adds the scores obtained from the two categories into a final low-to-critical rating. The scientists note that the capability gain is the most important dimension and acts as both a floor and a ceiling for the remaining scores — a jailbreak that doesn't offer results beyond what can already be obtained via other means is meaningless within the purview of the grading system.
The individual ratings pertain to capability gains, capability scope, ease of deployment, and ease of discovery. They're all graded from zero to three, though the FMF stresses that a rating of zero doesn't mean a jailbreak is harmless or ought to be ignored — rather, it means the flaw should be addressed by standard practices like the platform's policies and standard cybersecurity ratings.
An important feature is that the FMF's baseline implicitly changes as models evolve, meaning that a grade of zero for a jailbreak in 2026 likely isn't going to mean the same thing as it would in 2028, or isn't better than alternative tools. A capability-gain rating of zero means that the jailbreak under analysis doesn't offer any improvement beyond what can already be done with existing models or tooling right off the bat.
For example, jailbreaking a model to perform a DDoS on a site isn't all that helpful to an attacker, since there are a number of black-market sites for that — or even other LLMs with fewer safeguards. This doesn't mean the jailbreak isn't handy, only that it's no better than the alternatives. However, the rating can be higher if the attacker can leverage the jailbreak to get a better DDoS than they could otherwise shop for.