Anthropic has published a framework for rating how dangerous an AI jailbreak is, and says it developed the scale with input from Amazon, Microsoft and Google. The Cyber Jailbreak Severity (CJS) framework is meant to give AI developers, security researchers and customers a shared vocabulary for a problem that each company has so far judged by its own rules.
A jailbreak is a technique that pushes a model past the restrictions its developer built in, getting it to produce content or take actions the company intended to block. As frontier models have become capable of writing working code, assisting with software development and supporting security work, the stakes of a successful jailbreak have risen with them.
Five levels, four questions
Under the framework, each jailbreak is assigned a grade from CJS-0 to CJS-4. A flaw that only exposes information of limited value sits at the bottom of the scale. A jailbreak that could materially help an attacker carry out large-scale cyber operations or other serious harm sits at the top.
The grade rests on four questions, according to Anthropic’s description of the scheme and analyses of it by the Cloud Security Alliance and security trade press:
- How much does the jailbreak increase what the model will do beyond its normal limits (the capability uplift)?
- How broad is its reach: does it affect one narrow task or a wide range of behavior?
- How easy is it to turn into a working attack?
- How hard is it for an ordinary user or an attacker to discover?
One design choice stands out. A severity score can be raised later if new consequences come to light, but it is not meant to be lowered once assigned. The intent is to prevent a known flaw from quietly being downgraded over time.
Why it follows the Fable 5 pause
The announcement comes shortly after Anthropic’s most capable model, Claude Fable 5, was pulled back from general availability over concerns that its abilities could be misused for cyberattacks and malware development. Coverage of the episode puts the gap at roughly two and a half to three weeks before the model was redeployed with new safeguards.
Those safeguards changed how the model treats security-related requests. Rather than refusing anything that touches cybersecurity, Anthropic says its classifiers now sort such requests into several risk tiers, so that legitimate research, education and defensive security work can proceed while requests that point toward real-world attacks are blocked more consistently.
The CJS framework extends that thinking to the flaws themselves. If a model’s refusals can be bypassed, the question becomes not just whether a bypass exists but how much damage it enables, and that is what the scale is designed to answer.
A possible common standard
Anthropic is presenting CJS as a cross-industry proposal rather than an internal policy. Because Amazon, Microsoft and Google contributed to its development, security analysts expect it could become a shared reference point for reporting and disclosing AI security issues, in the way that vulnerability scoring systems work for conventional software.
Whether other labs adopt it remains to be seen. The Cloud Security Alliance, in a research note on the framework, treats it as a governance tool that boards and security teams can use to set thresholds for when a jailbreak requires escalation, while noting that a shared scale is only useful if the companies that build frontier models report against it consistently.
For now, the framework signals a shift in how at least one major developer talks about model security: less as a matter of whether a system can be tricked, and more as a matter of what happens when it is.
