Anthropic's Jailbreak Severity Scale Is Trying to Become the CVSS of AI Security. Here's What That Means for Developers.

Anthropic's proposed Cyber Jailbreak Severity framework rates AI model bypasses on a five-level scale. If the industry adopts it, every team building on frontier models will need to rethink how they handle prompt security, disclosure, and risk.

When a security researcher finds a buffer overflow in Linux, there's a playbook: file a CVE, score it with CVSS, coordinate disclosure, patch it. When someone finds a way to trick an AI model into ignoring its safety guardrails, there has been no equivalent process. No shared vocabulary, no severity tiers, no agreed-upon way to tell a government official whether a given jailbreak is a curiosity or a crisis.

Anthropic is trying to change that. On July 2, the company published a draft framework for scoring jailbreak severity, proposing what it calls the Cyber Jailbreak Severity (CJS) scale. The framework rates jailbreaks from CJS-0 (informational, minimal risk) through CJS-4 (critical, broad capability unlocks) across four technical axes. And Anthropic isn't positioning this as an internal tool. It's explicitly asking academia, rival AI labs, civil society groups, and governments to adopt, critique, and refine it.

The proposal didn't emerge from a whiteboard brainstorm. It came out of a genuine crisis that forced Anthropic offline for nearly three weeks and exposed how badly the AI industry needs a common language for jailbreak risk.

The Fable 5 Crisis That Forced the Conversation

To understand why a jailbreak scoring system matters, you need the backstory.

Anthropic released Claude Fable 5 and Claude Mythos 5 on June 9. Both share the same underlying model, but Fable 5 shipped with robust safety classifiers for general availability, while Mythos 5 — with fewer guardrails — was restricted to trusted partners in the government's Project Glasswing consortium. As WIRED reported in April, Project Glasswing brought together Apple, Google, Microsoft, and more than 45 other organizations to stress-test advancing AI cybersecurity capabilities using an earlier Mythos Preview model.

Three days after launch, things went sideways. On June 12, the US Commerce Department sent Anthropic a letter invoking export controls on both models, citing unspecified national security concerns. As Anthropic later explained, the company believed the letter was related to a report by Amazon researchers who had found a method of bypassing Fable 5's safeguards, prompting it to identify software vulnerabilities. Because the export directive took effect immediately and Anthropic had no way to verify user nationality in real-time, it suspended access to both models for everyone.

The result was stark. As TechCrunch's Zack Whittaker reported, the US government had effectively forced a tech company to pull its flagship products offline with a "swift and unilateral action that didn't appear to require court approval." Whittaker noted that Axios described "personality differences" between Anthropic and the Trump administration as a contributing factor, suggesting the export directive may have been as much political as technical.

Cybersecurity researcher Katie Moussouris, who founded Luta Security, reviewed the jailbreak in question and concluded that the bypass didn't actually produce novel attack capabilities beyond what was already publicly available, according to TechCrunch's reporting. In other words, the government may have shut down two frontier AI models over a jailbreak whose real-world severity was debatable — partly because there was no shared framework for evaluating that severity in the first place.

Fable 5 came back online on July 1 with updated safeguards. But the episode made one thing clear: without a common severity scale, any jailbreak report can become a political football, and the consequences can be immediate and drastic.

How the CJS Framework Actually Works

As we explored in our earlier coverage of the CJS scale, Anthropic's framework evaluates jailbreaks across four technical axes, producing a composite severity rating. The scale runs from CJS-0 through CJS-4, roughly analogous to how CVSS scores map to None, Low, Medium, High, and Critical.

Here's what each level means in practice:

CJS-0 (Informational): The jailbreak produces outputs that are technically outside the model's intended behavior but pose minimal real-world risk. Think of a prompt that gets the model to adopt an unusual persona without actually unlocking dangerous capabilities. These are the equivalent of a low-severity informational finding in a penetration test.

CJS-1 (Low): The bypass produces mildly undesirable outputs — perhaps overly detailed technical explanations that skirt guidelines — but nothing that meaningfully increases an attacker's capabilities beyond what's already available through a search engine.

CJS-2 (Medium): The jailbreak unlocks specific restricted behaviors, such as generating partial exploit code or detailed attack methodologies for known vulnerabilities. This is where things start getting operationally relevant.

CJS-3 (High): The bypass enables the model to assist with sophisticated attack chains, combining multiple techniques in ways that would meaningfully lower the barrier for a skilled attacker.

CJS-4 (Critical): A broad capability unlock. The jailbreak effectively strips the model's safety classifiers across a wide range of dangerous domains, making it functionally equivalent to an unsafeguarded model. This is the "Mythos without a leash" scenario.

The four axes Anthropic uses to evaluate where a jailbreak lands on this scale assess factors including the breadth of capabilities unlocked, the novelty of the information produced, the reliability and reproducibility of the bypass, and the level of expertise required to execute it. A jailbreak that works intermittently and produces information already available in textbooks scores very differently from one that reliably strips all classifiers and generates novel exploit chains.

What the Framework Covers — and What It Doesn't

Anthropic's July 2 post also provided a detailed breakdown of what Fable 5's safety classifiers are and aren't designed to block. This transparency is notable. Most AI labs treat their classifier architecture as proprietary. By publishing the scope of its safeguards alongside the severity framework, Anthropic is essentially giving security researchers a target list — and a bug bounty program to match. The company launched a HackerOne program specifically for Fable 5 cyber jailbreak submissions.

The CJS framework is explicitly scoped to cybersecurity-related jailbreaks. It doesn't attempt to score bypasses that produce, say, offensive political content or misinformation. That's a deliberate choice: cybersecurity harms are more concrete and measurable than content policy violations, making them a more tractable starting point for standardization.

What This Means for Developers Building on Frontier Models

If the CJS framework gains traction beyond Anthropic, the practical implications for developers are significant. Here's where it gets concrete.

Disclosure and response obligations shift. Right now, if a developer building on Claude, GPT, or Gemini discovers that a particular prompt chain bypasses safety guardrails, there's no standardized way to report it or describe its severity. A CJS-like framework would create structured disclosure expectations. A CJS-1 finding might warrant an email to the model provider. A CJS-3 might trigger coordinated disclosure timelines similar to those in traditional vulnerability research.

SLA and liability language gets more precise. Enterprise contracts for AI model access are currently vague about what constitutes a "safety failure." A standardized severity scale gives legal and procurement teams specific language to work with. You could imagine contract clauses specifying response times based on CJS levels, much like how cloud providers commit to different response SLAs for P1 versus P3 incidents.

Security teams need new skills. Traditional application security engineers understand OWASP Top 10 and CVSS scoring. Prompt injection and jailbreak evaluation require different expertise — understanding model architectures, classifier behavior, and the gap between a model's training-time alignment and its runtime guardrails. If CJS becomes a standard, security teams will need to build or hire for these skills.

Red-teaming becomes more structured. Companies that red-team their AI deployments currently lack a consistent way to prioritize findings. A severity framework turns ad hoc jailbreak discovery into a structured assessment process with clear escalation paths.

The Political Dimension: Why Standardization Is Also a Shield

There's a defensive logic to Anthropic's proposal that goes beyond technical rigor. The Fable 5 episode demonstrated that without a shared severity framework, governments can treat any jailbreak report as justification for sweeping action.

Consider the sequence of events: Amazon researchers found a bypass. The government issued export controls. Anthropic pulled its models. Millions of users lost access. And the jailbreak in question may not have actually produced capabilities beyond what was already publicly available, as Moussouris's analysis suggested according to TechCrunch's reporting.

A standardized severity framework gives AI companies a structured way to push back. If a government points to a jailbreak report and demands action, the company can respond with a CJS assessment: "This is a CJS-1 finding. Here's why. Here's what it does and doesn't unlock. Here's our remediation timeline." That's a very different conversation than "we found a bypass" met with "shut it down."

This dynamic also matters for the broader relationship between the AI industry and regulators. As TechCrunch's Whittaker wrote, the Fable 5 incident was "a warning to the wider tech industry: comply, or we can shut you and your products down." A severity framework doesn't prevent government overreach, but it creates an evidentiary standard that makes arbitrary action harder to justify.

The Adoption Question: Will Anyone Else Use This?

Anthropic is positioning CJS as an industry proposal, not a proprietary tool. The company is soliciting feedback at a dedicated email address and has explicitly invited rival labs to participate. But adoption is far from guaranteed.

The Glasswing consortium gives Anthropic a head start. With Apple, Google, Microsoft, Nvidia, Cisco, the Linux Foundation, and more than 40 other organizations already collaborating on AI cybersecurity through the program — as WIRED reported when the consortium was announced — there's a built-in audience for the framework. Several Glasswing partners were involved in developing the CJS scale, according to Anthropic's own account.

But there are reasons for skepticism. OpenAI and Google have their own internal approaches to evaluating model safety. Adopting Anthropic's framework means accepting Anthropic's definitions, Anthropic's severity thresholds, and implicitly, Anthropic's framing of what constitutes acceptable risk. Competitive dynamics may make rival labs reluctant to cede that ground.

There's also a question of scope. CJS is deliberately limited to cybersecurity jailbreaks. The broader universe of model safety concerns — bias, misinformation, manipulation — remains unaddressed. A framework that covers only one category of harm, however well-defined, may struggle to become the universal standard Anthropic envisions.

The most likely near-term outcome is partial adoption: government agencies and defense-adjacent organizations adopt CJS because they need a common vocabulary for procurement and incident response, while commercial AI labs develop compatible but distinct internal frameworks. That's roughly how CVSS evolved — not as a single universal standard, but as a widely referenced baseline that different organizations adapt to their needs.

What Comes Next

The CJS framework is a draft. Anthropic has said as much, and the company's invitation for critique suggests it expects significant revision. Several open questions will shape whether this proposal becomes a lasting standard or a historical footnote.

First, who governs it? CVSS is maintained by FIRST, an international nonprofit. If CJS remains an Anthropic project, it will always carry the perception of serving Anthropic's interests. Transferring stewardship to an independent body — perhaps one of the Glasswing partner organizations like the Linux Foundation — would boost credibility.

Second, how does it handle rapid capability jumps? A jailbreak rated CJS-1 today might become CJS-3 tomorrow if a new model makes the unlocked information more actionable. The framework needs a mechanism for re-evaluation as the underlying models evolve.

Third, does it extend beyond cyber? The deliberate scoping to cybersecurity makes the framework tractable, but the AI safety community will eventually need severity scales for other harm categories. Whether CJS becomes a template for those efforts or an isolated initiative depends on how well the first version works in practice.

What's clear is that the status quo — no shared vocabulary, no severity tiers, no coordinated disclosure norms — isn't sustainable. The Fable 5 crisis proved that. A single ambiguous jailbreak report was enough to trigger export controls, pull frontier models offline, and disrupt access for users worldwide. Whether the CJS framework is the right answer or merely the first serious attempt at one, the question it's trying to answer is now impossible to ignore.