Every frontier AI lab eventually faces the same awkward conversation with a security researcher: “We found a way to bypass your safety filters. Now what?” Until this month, the answer was mostly improvisation - a private email, a hushed patch, and a vague blog post. Anthropic has just tried to replace that ritual with something that looks a lot like a scoring system.
In a post quietly published this week alongside its new Fable 5 model, Anthropic introduced the Cyber Jailbreak Severity (CJS) framework, a four-axis score that ranks every disclosed bypass from CJS-0 (Informational) to CJS-4 (Critical). It is the first concrete attempt by a major lab to put numbers on jailbreak risk, and it lands against a backdrop we have been tracking since February, when MLCommons documented how broken jailbreak benchmarking had become. The design choices tell you a lot about where frontier AI safety is heading.
What the framework actually measures
The CJS framework scores jailbreaks along four axes, according to Anthropic’s announcement:
- Capability gain (uplift) - does the jailbreak give domain experts a new tool, or only help novices? Scored 0-4.
- Breadth of capability gain - how universal is it across vulnerability types? Scored 0-2.
- Ease of weaponization - does it need an LLM-skill expert to deploy? Scored 0-2.
- Discoverability - how hard was it to find? Scored 0-2.
The four sub-scores combine into bands. A score of 0 lands in the CJS-0 (Informational) bucket. Anything from 1 to 3.5 is CJS-1 (Low). Medium is CJS-2. High is CJS-3. Critical is CJS-4, which requires at least 9 of 10 possible points.
A few worked examples from the appendix show how the scale bends over time. When the Log4Shell vulnerability was first disclosed in December 2021, identifying it with an LLM would have scored CJS-4, because “no other tool or model exists that can find it.” Identify Log4Shell today, and the same prompt drops to CJS-0 - the vulnerability is public knowledge. Capability gain is measured against the tools available at the time of assessment, not against an absolute yardstick.
That single design choice matters. It means a bypass that looks scary in a research paper today can quietly become a non-event in 18 months once defenders catch up. Severity is a moving target, and Anthropic’s framework is built around that.
A four-tier classifier, and a parallel model for defenders
Fable 5 does not run on the CJS framework alone. It also routes requests through a four-tier cyber classifier (Anthropic):
- Prohibited use is blocked outright.
- High-risk dual use is also blocked.
- Low-risk dual use is monitored, and sometimes blocked with a deliberately large “safety margin.”
- Benign use is allowed.
The categories are not abstract. The Prohibited bucket includes ransomware, wipers, destructive payloads, cyber-physical sabotage, defense evasion, command-and-control channels, data exfiltration, malware development, supply-chain compromise, BGP hijacking, and DNS attacks. High-risk dual use covers penetration testing, red teaming, exploitation, credential attacks, privilege escalation, ICS and SCADA targeting, telecom core abuse (SS7 and Diameter), financial-infrastructure attacks, and “high-uplift vulnerability finding.” Benign use includes secure coding, debugging, IT administration, firewalls, IDS, EDR, patch management, SOC analysis, malware reverse engineering, and “discussing widely known security practices.”
Fraud, scams, game cheating, CAPTCHA solving, wallet stealing, and techniques to extract the system prompt are explicitly out of scope.
When Fable 5’s classifier fires, it routes the flagged request to a weaker sibling, Claude Opus 4.8, and tells the user about the handoff. According to The Hacker News, the fallback fires in fewer than 5% of sessions, which means Fable 5 behaves like its unrestricted twin Mythos 5 more than 95% of the time. In internal evaluation with block mode on, classifiers stopped the model from progressing on offensive cyber tasks. An external bug bounty ran over 1,000 hours with no universal jailbreak, though Anthropic concedes the UK AI Security Institute made progress toward one during initial testing. The stated goal is not impossibility - it is making the remaining jailbreaks slow and costly to find.
Why the timing matters
Three days after Fable 5 launched on June 9, the US government, citing national security authorities, issued an export-control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national - whether inside or outside the United States, including foreign-national Anthropic employees - after a potential narrow, non-universal jailbreak was shared with the government. In Anthropic’s account, the demonstrated technique was used to “identify a small number of previously known, minor vulnerabilities” that other publicly available models can also discover without a bypass. Anthropic called it a “misunderstanding” but complied, removing access for all users to ensure compliance. The export controls were lifted on June 30, and Fable 5 returned to Claude.ai, the Claude Platform, Claude Code, and Claude Cowork on July 1.
The new severity framework reads, in part, as a response to that episode. A disclosed bypass no longer has to trigger a regulator; it can be triaged by score. A CJS-0 finding does not need a Commerce Department ticket. A CJS-4 finding still does.
Anthropic has also opened two formal channels. Researchers can email [email protected] or report through the company’s HackerOne program at hackerone.com/anthropic-cyber-jailbreak/. The CJS framework itself was built with the company’s Project Glasswing partners, which include AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks.
What This Means
A severity scale is only useful if other labs adopt it. Today, Anthropic is the only frontier lab publishing a structured jailbreak-severity framework with sub-scores, time-decay rules, and worked examples. OpenAI, Google DeepMind, and xAI all have safety teams, and all of them triage jailbreaks internally, but none of them publish a comparable public rubric. Until they do, the CJS framework is a single-vendor vocabulary.
For defenders, the upside is real. A shared scoring system would let security teams triage incoming AI-risk advisories the same way they triage CVEs - by severity band, by patch priority, and by exposure window. The CJS-0-to-CJS-4 layout mirrors the Common Vulnerability Scoring System well enough that incident-response playbooks could be ported over with light editing.
For privacy-focused users, the framework is also a small but useful signal that the most powerful cyber model Anthropic has ever shipped is, in its public form, deliberately less capable than the model running on Mythos 5. That split is unusual in the industry, and it is the most interesting part of the launch.
The Bottom Line
Anthropic has turned jailbreak disclosure into a numbered, time-decaying object. If OpenAI and Google publish comparable rubrics in the next quarter, AI safety moves from anecdote to audit trail. If they do not, CJS becomes a one-lab standard - useful, but only inside one vendor’s threat model.