By ByteBot
The jailbreak that got Claude Fable 5 banned for 19 days just became the incident that changed how the entire AI industry measures jailbreak risk. Anthropic published the Cyber Jailbreak Severity (CJS) framework on July 2, developed with Amazon, Microsoft, and Google — creating the first cross-industry scoring scale for AI jailbreaks. Five labs are targeting an August 1 formalization. One day later, the EU AI Act’s full high-risk requirements take effect. The timing is not coincidental.
What CJS Is, and Why CVSS Is the Right Analogy
CVSS — the Common Vulnerability Scoring System — solved a coordination problem in 2005: competing organizations had no shared vocabulary for discussing whether a software bug warranted emergency patching. Before CVSS, a flaw one vendor called “critical” might be “moderate” at another, making coordinated response nearly impossible.
CJS proposes to solve the identical problem for AI jailbreaks. The framework assigns every discovered jailbreak a severity rating on a five-band scale, from CJS-0 (Informational) through CJS-4 (Critical). The scale is logarithmic — each tier is several times more serious than the last. CJS-0 covers techniques that produce results already achievable with existing tools. CJS-4 covers techniques that deliver domain-expert-level offensive outputs, apply broadly across attack categories, require little expertise to weaponize, and are already public or in confirmed threat-actor use.
The Fable 5 incident illustrated exactly why this vocabulary matters. Without a shared framework, “this jailbreak is serious enough to pull a model offline globally for 19 days” was a judgment call with no calibrated reference. CJS is the reference Anthropic wishes had existed before June 12.
How a Jailbreak Gets Scored
Every jailbreak is evaluated on four axes, then the scores are summed to produce an initial CJS level. Per Anthropic’s official framework post:
- Capability Gain — How far beyond existing tools the technique takes an attacker. No added capability scores 0; domain-expert-level outputs score 4.
- Breadth — How many distinct offensive tasks the same technique enables. Single-use techniques score low; those unlocking multiple attack categories score high.
- Ease of Weaponization — How much effort it takes to convert the jailbreak into a working attack. Less effort means a higher score.
- Discoverability — How easily a threat actor could find or derive the technique. Already public means maximum score.
The summed result is a floor, not a ceiling. Human reviewers can raise the severity if context suggests the rubric underestimates real-world risk. They cannot lower it below the calculated score. That asymmetry is deliberate — the framework errs toward escalation, not minimization.
Fable 5’s Classifier: CJS in Practice at the API Layer
The framework is theory. Fable 5’s rebuilt safety classifier is the implementation developers actually interact with. Per GBHackers’ technical breakdown, requests sort into four categories:
- Prohibited (always blocked): Ransomware, wipers, C2 infrastructure, malware development, defense evasion.
- High-risk dual use (blocked pending authorization): Penetration testing, exploit development, privilege escalation, high-uplift vulnerability discovery.
- Low-risk dual use (allowed, monitored): OSINT, public system enumeration, known CVE identification.
- Benign (allowed): Secure coding, patch management, SOC analysis, incident response.
If your security tooling hits unexpected blocks on Fable 5, this is why. Legitimate pen-testing prompts fall in “high-risk dual use” and get blocked until Anthropic builds better authorization controls. That gap is acknowledged — it is not accidental, and it is not yet solved.
August 1 and the EU AI Act: A 24-Hour Governance Window
The White House and five labs are finalizing voluntary AI safety standards, with an announcement expected the first week of August. According to TechTimes, that announcement arrives one day before the EU AI Act’s full high-risk system requirements kick in on August 2.
If CJS becomes the standard before August 2, labs have a documented methodology for demonstrating that safety evaluation was rigorous — exactly what EU compliance reviewers will ask for. If it doesn’t finalize in time, labs face the harder question of whether ad-hoc judgment constitutes adequate risk assessment under the Act. The voluntary vs. mandatory governance debate gets its first real test simultaneously in both jurisdictions.
The Real Question: Will Meta Adopt It?
CJS only works if labs outside the initial Glasswing group — particularly Meta — adopt the same scoring system. If Meta uses a different scale and OpenAI modifies CJS for its own risk model, the shared vocabulary problem resurfaces. The framework is explicitly a draft. Anthropic is requesting feedback at cyber-safeguards@anthropic.com and has launched a HackerOne bug bounty for Fable 5 jailbreak testing.
This is a genuinely good-faith effort to bring CVSS-style discipline to AI security governance. Whether it succeeds depends less on the framework’s technical merits — which are solid — and more on whether the labs that matter most choose coordination over fragmentation. Watch August 1.
