Anthropic on July 2, 2026 published the Cyber Jailbreak Severity (CJS) framework, a scoring system that rates each AI jailbreak on a five-level scale from CJS-0 to CJS-4. CJS scores a single jailbreak technique across four axes for a total between 0 and 10, then maps that total onto a severity label running from CJS-0 (Informational) to CJS-4 (Critical). Anthropic built the framework together with its Glasswing partners, alongside the cybersecurity safeguards it shipped for Claude Fable 5. ASAP summarizes this directly from Anthropic's official announcement as the primary source.

Jailbreaks now get a severity grade

CJS assigns every AI jailbreak one of five levels from CJS-0 to CJS-4. Anthropic defines a jailbreak as "an unusual way of prompting an AI model to bypass its safeguards," and sorts each technique by total score into CJS-0 Informational (0), CJS-1 Low (1–3.5), CJS-2 Medium (4–6.5), CJS-3 High (7–8.5), and CJS-4 Critical (9–10). Where jailbreaks were previously discussed only as success or failure, CJS puts a number on how dangerous a given break actually is.

Four axes add up to the total

A CJS total is the sum of four axes: Capability Gain, Breadth, Ease of Weaponization, and Discoverability. Capability Gain, scored 0–4, measures how far beyond existing attacker tools the jailbreak takes them. Breadth, scored 0–2, asks how many distinct targets, tasks, or attack types the same technique works on. Ease of Weaponization, scored 0–2, gauges the effort to go from knowing the technique to producing a working attack, and Discoverability, scored 0–2, rates how easily a threat actor can obtain it. The maxima sum to exactly 10, and a single axis — Capability Gain — accounts for four of those points.

Use is split into four categories

Alongside CJS, Anthropic divides cybersecurity uses into four categories: Prohibited, High-risk dual use, Low-risk dual use, and Benign. Prohibited use covers activities that could cause significant harm or are harmful in most of their uses, while High-risk dual use covers activities with harm potential but legitimate defensive applications. Low-risk dual use is mostly used for defensive benefit, and Benign use carries minimal harm risk. If the severity axes measure how bad a jailbreak is, these four categories separate what someone intends to do with the capability.

Why build a scorecard now

The framework reads as a move from ad-hoc reaction toward standardized prioritization. The practical problem a defender faces is not whether a jailbreak works but which of many reports to fix first, and without grades a trivial bypass and a critical one pile up with equal weight. Anthropic opened intake through a cyber-safeguards@anthropic.com address and a HackerOne bug bounty at the same time, and pairing a scoring system with reporting channels signals an intent to classify outside researchers' findings by severity and queue them accordingly. In other words, CJS is built for triage, not publicity.

How it differs from software-vulnerability scoring

CJS stands out as an attempt to carry a long-standing software-vulnerability severity approach over to the unfamiliar object of AI jailbreaks. Software flaws have had a shared 0–10 severity scale for years, but AI jailbreaks lacked any common language, so risk was described against different yardsticks each time. What CJS fills is not the score itself but the jailbreak-specific axes such as ease of weaponization and discoverability. Unlike a code vulnerability, a jailbreak does not close with a single patch but resurfaces as prompts change, which is why how easily it spreads and how easily it reproduces move to the center of severity.

How to read the numbers

The most striking design choice is the weighting that hands one axis, Capability Gain, 40 percent of the 10-point maximum. Giving Capability Gain a 0–4 range while Breadth, Ease of Weaponization, and Discoverability each get 0–2 says Anthropic treats "how much stronger the attacker actually becomes" as more central to risk than "how widely known it is." A note of caution is equally clear: all four axes are set by human judgment rather than a benchmark score, so the same jailbreak could land at CJS-2 for one rater and CJS-3 for another. The announcement includes no worked example scores, leaving the scale's rigor to be tested in practice.

Open questions

CJS establishes a first version, yet three open questions remain about its objectivity, its collaborators, and its adoption. With Anthropic scoring its own techniques, it is unclear how the grades' objectivity is assured, or what role Glasswing — named only as a collaborator — plays in the scoring. Above all, the scale earns its value only when severity grades translate into actual defensive priority and disclosure scope. Whether CJS hardens into an industry standard or stays an internal taxonomy depends on whether other frontier labs adopt the same language.

Source: Anthropic official announcement (2026-07-02, "A framework for rating the severity of AI jailbreaks", anthropic.com/news/fable-safeguards-jailbreak-framework).