Anthropic's Jailbreak Severity Scale: The Quiet Push to Give AI Safety a Common Language

Anthropic's Cyber Jailbreak Severity framework proposes a CVE-like scoring system for AI model exploits. If adopted industry-wide, it could reshape how companies, governments, and researchers talk about AI risk.

When a cybersecurity researcher discovers a software vulnerability, the industry has a shared playbook. CVE identifiers catalog the flaw. CVSS scores rate how bad it is. Coordinated disclosure gives vendors time to patch. AI model jailbreaks — techniques that trick a model into bypassing its safety guardrails — have had no equivalent system. Anthropic is trying to change that with a draft framework it calls the Cyber Jailbreak Severity (CJS) scale, and the backstory of why it exists reveals just how messy the current landscape really is.

As we covered when the framework first dropped, Anthropic published the CJS scale on July 2 as part of a broader set of disclosures about its most capable model, Claude Fable 5. The framework rates jailbreaks from CJS-0 (informational, minimal risk) to CJS-4 (critical, broad capability unlocks) across four technical axes. It's designed not just for Anthropic's internal use but as a proposed standard that other AI companies, academics, civil society groups, and governments could adopt.

The idea is deceptively simple: give everyone the same vocabulary for describing how dangerous a given jailbreak actually is. The execution is anything but.

The Fable 5 Crisis That Forced the Conversation

The CJS framework didn't emerge from a calm strategic planning session. It was born from a weeks-long crisis that exposed how unprepared the industry is to talk about jailbreak risk in consistent terms.

Anthropic released Claude Fable 5 and Claude Mythos 5 on June 9. Both share the same underlying model. Fable 5 shipped with robust safety classifiers for general use, while Mythos 5, with fewer safeguards, was restricted to trusted partners in the US government's Project Glasswing program for defensive cybersecurity work.

Three days later, things went sideways. On June 12, the US government imposed export controls on both models after Amazon researchers reportedly found a method to bypass Fable 5's safeguards, prompting it to identify software vulnerabilities in ways Anthropic's classifiers were supposed to block. According to Anthropic's own account, the export controls took effect immediately. Because the company had no reliable way to verify user nationality in real time, it pulled both models for all users globally.

Fable 5 was unavailable for nearly three weeks. When Anthropic announced its redeployment on June 30, the company detailed updated cybersecurity classifiers and, crucially, the CJS framework it had been developing with its Glasswing partners during the downtime.

The lesson from this episode is clear: when a jailbreak is discovered, there's currently no shared way to assess whether it's a minor prompt trick or a serious capability unlock. The Amazon researchers found something concerning enough to trigger government action, but the public conversation around it lacked any standardized way to describe the severity. Was it a CJS-2 (moderate) or a CJS-4 (critical)? Without a framework, that question couldn't even be asked coherently.

How the CJS Scale Actually Works

As we explored in our earlier analysis of the framework, the CJS scale evaluates jailbreaks across four axes, producing a composite severity rating. Think of it like CVSS scoring for traditional software vulnerabilities, but adapted for the specific weirdness of language model exploits.

The five severity levels run from CJS-0 through CJS-4:

• CJS-0 (Informational): The jailbreak produces outputs that are technically outside intended behavior but pose minimal real-world risk. Think of a model generating mildly off-topic content when pushed with adversarial prompts.
• CJS-1 (Low): The bypass produces undesirable outputs, but the information is broadly available elsewhere and doesn't represent a meaningful capability uplift.
• CJS-2 (Moderate): The jailbreak unlocks specific restricted behaviors. The outputs could be harmful in context but don't represent broad capability access.
• CJS-3 (High): A significant bypass that unlocks dangerous capabilities across multiple domains, potentially providing meaningful uplift to a malicious actor.
• CJS-4 (Critical): A broad capability unlock that effectively neutralizes the model's safety layer, making it behave like an unsafeguarded system.

The four axes that feed into these ratings assess different dimensions of the jailbreak: how reproducible it is, how broad the capability unlock extends, how much real-world uplift it provides to an attacker, and how resistant it is to simple mitigations.

This multi-axis approach matters because not all jailbreaks are created equal. A prompt injection that works once in a hundred attempts and produces vaguely concerning output is fundamentally different from a systematic technique that reliably strips away safety classifiers across a wide range of harmful queries. The CJS scale is designed to capture that distinction quantitatively.

Anthropic's framework also draws a line between what its classifiers are and aren't designed to prevent. As the company detailed in its July 2 disclosure, Fable 5's safety classifiers are specifically tuned for cybersecurity harms — detecting and blocking attempts to use the model for offensive vulnerability discovery, exploit development, and related tasks. The CJS scale, while initially focused on cyber jailbreaks, is structured broadly enough to extend to other harm categories.

The Gap Between Catastrophic Risk and Everyday Harm

Anthropic's framework focuses on the sharp end of AI risk: cybersecurity exploits, capability unlocks, the kind of jailbreaks that could help someone build something dangerous. This is important work. But it also highlights a persistent blind spot in how the AI safety field prioritizes threats.

Writing for Personal AI Safety, Sofia Quintero has argued that the industry treats catastrophic risk as the priority while treating everyday cognitive and mental health harms as a footnote. She points to a striking asymmetry in how models handle different categories of dangerous interaction: content related to mass destruction or CBRN threats gets a hard wall — the model refuses, the conversation ends. Suicidal ideation gets a soft redirect, a crisis hotline link, and then the conversation continues.

Quintero's framing raises an uncomfortable question for any jailbreak severity framework: severity for whom? A CJS-4 jailbreak that unlocks offensive cyber capabilities is clearly dangerous at scale. But the framework doesn't address scenarios where a model's intended behavior — not a bypass of it — causes harm to individual users.

This isn't a flaw in Anthropic's specific proposal so much as a reflection of where the industry's attention sits. The CJS scale is explicitly scoped to cybersecurity jailbreaks. But if the framework succeeds and becomes an industry standard, there will be pressure to extend it to other harm categories. When that happens, the question of how to score severity for personal safety harms — emotional manipulation, self-harm facilitation, unhealthy dependency — becomes unavoidable.

Any future version of the framework will need to grapple with the fact that some of the most widespread harms from AI systems aren't the result of jailbreaks at all. They're features of normal operation.

What Industry Adoption Would Actually Require

Anthropic is positioning the CJS scale as a starting point, not a finished product. The company has invited feedback at a dedicated email address and launched a HackerOne program for security researchers to submit potential cyber jailbreaks in Fable 5 for review. This is the right approach — a framework like this only works if it's stress-tested by people who actually find and exploit model vulnerabilities.

But moving from a single company's draft proposal to an industry-wide standard involves several hard problems.

Competitive dynamics. For the CJS scale to work across companies, OpenAI, Google DeepMind, Meta, and others would need to adopt compatible scoring. That means agreeing on definitions of severity, which implicitly means agreeing on what capabilities their models have and how effectively their safeguards work. Companies have strong incentives to downplay the severity of jailbreaks found in their own models. A shared framework makes that harder, which is precisely why some companies may resist adopting one.

Government integration. The Fable 5 episode demonstrated that governments are already making high-stakes decisions about AI model access based on jailbreak reports. Export controls were imposed based on a single research finding. A standardized severity scale could give policymakers a more calibrated tool for these decisions, but only if government agencies trust and understand the framework. The CJS scale's origins in the Glasswing partnership suggest Anthropic is already working this angle.

Reproducibility and verification. Traditional CVE scoring benefits from the fact that software vulnerabilities are typically reproducible: you can demonstrate the exploit, and independent researchers can verify it. Language model jailbreaks are fuzzier. A prompt technique that works reliably on one model version may fail after a minor update. The CJS framework's reproducibility axis addresses this, but the inherent instability of language model behavior makes independent verification harder than in traditional security research.

Scope creep. The framework is currently scoped to cybersecurity jailbreaks. As noted above, pressure to extend it to other harm categories is inevitable. Each extension will require its own set of domain-specific definitions and severity calibrations. A jailbreak that unlocks bioweapons information is different in kind from one that bypasses content moderation for hate speech, even if both might rate as "high severity."

The Disclosure Problem

There's also the question of what happens when a high-severity jailbreak is found. In traditional cybersecurity, coordinated disclosure gives vendors a window to patch before the vulnerability is made public. Anthropic's HackerOne program suggests a similar model for AI jailbreaks.

But patching a language model isn't like patching software. You can update classifiers relatively quickly, but fundamentally changing a model's behavior in response to a novel jailbreak technique may require retraining or fine-tuning, which takes time and resources. During that window, the jailbreak exists in the wild. A CJS-4 finding creates a genuine dilemma: disclose it publicly and risk widespread exploitation, or keep it quiet and risk that others discover it independently without any coordinated response.

The CJS framework doesn't solve this problem, but it does create the vocabulary to have the conversation. A CJS-4 finding triggers a different response protocol than a CJS-1. That graduated approach is more useful than the current binary of "jailbreak found" or "no jailbreak found."

Where This Goes Next

Anthropic's CJS scale is, by the company's own description, an early draft. Its real test won't be whether Anthropic uses it internally — they already are. The test is whether other frontier AI labs adopt compatible frameworks, whether governments reference CJS ratings in policy decisions, and whether the security research community finds the scoring system useful enough to build on.

The closest analogy remains CVSS, which took years to move from a draft proposal to an industry fixture. CVSS succeeded because it solved a real coordination problem: security teams at different organizations needed a common language to prioritize vulnerability remediation. The AI industry has the same coordination problem with jailbreaks, arguably more urgently given the pace of capability development.

If the CJS scale gains traction, it could do something more important than standardize jailbreak scoring. It could force the industry to be specific about what its models can do when their guardrails are removed. Right now, that conversation happens in vague terms — "safety bypass," "alignment failure," "harmful output." A severity framework demands precision. It asks: what exactly was unlocked, how reliably, and how much does it matter?

That precision is uncomfortable for companies whose business models depend on the perception that their models are safe. It's also exactly what the field needs.