Anthropic is proposing a common framework for scoring AI jailbreak severity with Amazon, Microsoft, Google, and other Glasswing partners.
What a shared jailbreak severity score is for
Jailbreaks are prompts or interaction patterns that push a model past its safety boundaries. Today, different labs and vendors describe those failures in their own language: one team calls something "high risk," another logs it as a policy miss, and a third treats it as a red-team curiosity. Without a shared scale, the same failure looks more or less serious depending on who reports it. That makes it hard to compare findings, prioritize fixes, or decide when a model is ready for wider use.
Anthropic’s proposed framework aims at that gap: a common way to score how severe a jailbreak is, so partners can talk about the same incident in the same terms. Glasswing is the collaboration surface for that idea—Amazon, Microsoft, Google, and other partners working from one scoring language instead of a stack of private rubrics.
What “severity” has to capture
Severity is not the same as novelty or cleverness. A flashy jailbreak that only produces mild, easily refused content is less urgent than a quieter one that reliably elicits harmful assistance at scale. A useful score has to weigh factors that matter in production, not only in a research write-up.
- How reliably the jailbreak works across prompts, models, or small wording changes
- How harmful the elicited behavior could be if it succeeded in the wild
- How much skill or access an attacker would need to reproduce it
- Whether mitigations already blunt it, or whether it still lands on current safety layers
Framing those dimensions explicitly helps security and product teams stop arguing about labels and start ranking work: patch first, monitor next, document for later.
Why multi-vendor alignment matters
Enterprises rarely run one model from one vendor. A security review that uses Anthropic’s language for one system and a different scale for another forces teams to translate every finding by hand. A shared Glasswing-backed severity framework reduces that translation cost. Bug bounty programs, red teams, and model evaluations can tag issues once and have those tags remain meaningful when findings move between vendors or compliance reviews.
It also improves signal quality. If everyone scores the same way, industry-wide patterns become visible: which classes of jailbreaks keep reappearing, which mitigations actually move the needle, and where defenses diverge. That does not require sharing proprietary model weights—only agreeing on how to grade failures when they show up.
How to use a framework like this in practice
Treat the score as an input to decisions, not a substitute for them. Map severity bands to clear actions: immediate patch and customer communication for the highest band; scheduled hardening and regression tests for the middle; logging and trend tracking for the lower band. Keep the mapping written down so two reviewers do not invent different responses for the same score.
When you evaluate a new model or a safety update, run the same jailbreak suite and record severity scores before and after. Improvement is then a shift in the distribution of scores, not a vague claim that “safety got better.” Share those scores with partners using the same labels Glasswing partners adopt, so external reports line up with your internal backlog. The value of Anthropic’s proposal is not a new buzzword—it is a common ruler so “how bad is this jailbreak?” stops being a negotiation every time.