The security world has had CVSS since 2005. If you've worked in infosec for more than a week, you know the drill: a vulnerability lands, you pull the CVSS score, you know immediately whether it's a "fix next sprint" or a "wake someone up at 2am" situation. Not a perfect system. But a shared language, and shared language turns out to matter more than perfect scoring.

AI jailbreaks have not had that. Until, maybe, now.

Anthropic published a proposed Cyber Jailbreak Severity (CJS) framework on July 1, alongside Amazon, Microsoft, Google, and Glasswing partners. Five tiers — CJS-0 (None, or informational) through CJS-4 (Critical) — scored across four axes. Exponential bands: each step up is several times more serious than the last. The framing explicitly invokes CVSS. The goal is a common vocabulary for triaging jailbreak findings, communicating risk to government partners, and triggering consistent responses across labs.

The framework is sensible. The scale itself is not the hard part.

What the four axes actually score

The CJS system rates a jailbreak on two pairs of criteria.

The first pair describes what the jailbreak gives an attacker: capability gain (also called uplift — how far beyond tools already available to the attacker the technique takes them) and breadth of capability gain (also called universality — how many distinct offensive tasks the same jailbreak unlocks). A technique giving marginal uplift on one narrow task scores low on both. A technique that unlocks significant capability across multiple offensive categories scores high on both.

The second pair describes how quickly a jailbreak can become a real-world problem: ease of weaponization (how much effort and skill it takes to go from knowing the jailbreak to executing an attack) and discoverability (how findable the technique already is — requires specialist knowledge scores low; already posted widely online scores high).

At CJS-4, Anthropic commits to deploying mitigations the moment severity is confirmed, backed by a team running 24-hour monitoring of jailbreak submission channels. That's a real commitment. Worth noting: CJS-4 is described as a "turnkey" jailbreak enabling domain-expert-level attacks across multiple offensive categories. We haven't seen one at scale in the wild. The severity band exists for contingency planning.

Source spread

• Anthropic — Fable 5 cyber safeguards and jailbreak framework — [safety]. Primary source for CJS framework, four-axis scoring, tier definitions, and CJS-4 response protocol.
• AI Weekly — Anthropic redeploys Fable 5 with cross-lab jailbreak rubric — [builder]. Good summary of the CVSS analogy and Glasswing partnership context.
• Bregg.com — Fable 5 restored and jailbreak severity framework — [builder]. Solid walkthrough of what the framework commits to and what it leaves open.
• Cryptobriefing — Anthropic details Fable 5 cybersecurity safeguards — [skeptic]. Notes the framework is a proposal, not a ratified standard, and raises the coordination question.

Pros & cons

What's real:

• The CVSS analogy is apt and useful. Security teams already understand severity banding. A shared vocabulary that plugs into existing risk-management workflows is the right approach.
• The four-axis scoring is more specific than previous jailbreak-severity frameworks from labs. The capability-gain vs breadth distinction is important: a narrow-but-severe technique and a broad-but-shallow one deserve different treatment. CJS handles that.
• Amazon, Microsoft, and Google co-developing this matters. Cross-lab standards only work if multiple labs agree to use them. The fact that three of the five largest AI infrastructure providers are at the table on a first draft is not nothing.
• The CJS-4 response commitment is concrete: real-time mitigation, 24-hour monitoring. That's a documented accountability signal, even if enforcement is self-reported.

What deserves a side-eye:

• This is a proposal, not an adopted standard. CVSS is maintained by FIRST — Forum of Incident Response and Security Teams — with hundreds of organizational members and decades of iteration. The CJS framework is a working paper with three named co-developers. The gap between those two things is a lot of organizational work.
• The CVSS parallel has a quiet flaw: CVSS works because there's an ecosystem around it. CVE registries, researcher submission programs, coordinated disclosure timelines, mandatory vendor response windows. None of that infrastructure exists for AI jailbreaks. A severity scale without the surrounding process is a rubric, not a safety system.
• The discoverability axis creates a weird incentive. If a jailbreak scores lower because it's not yet widely known, labs have less urgency to address it. The fix-when-public dynamic is exactly the bug in legacy software security that the responsible-disclosure movement spent 20 years fighting. AI is about to replay that arc.

What builders need to know

Further reading

• Anthropic — More details on Fable 5's cyber safeguards and jailbreak framework — primary source for CJS scale, four axes, tier definitions, CJS-4 response protocol
• AI Weekly — Anthropic redeploys Fable 5 with cross-lab jailbreak rubric — cleanest summary of the CVSS parallel and partnership context
• Bregg.com — Fable 5 restored and jailbreak framework — good walkthrough of what the framework does and doesn't commit to
• Cryptobriefing — Anthropic details Fable 5 cybersecurity safeguards — skeptical read on proposal-vs-standard distinction