When Anthropic, Google, Amazon, and Microsoft Agree: What the New Safety Standard Means for Your Business

Four companies that usually fight each other over every percentage point of market share in language models agreed in early July 2026 on something that had never existed in this form before: a common yardstick for how dangerous an AI jailbreak actually is. Anthropic, together with Amazon, Google, and Microsoft, plus other partners from the so-called Project Glasswing, proposed the Cyber Jailbreak Severity Scale (CJS) - a rating framework that will classify security vulnerabilities in AI systems by unified criteria going forward. To executives and IT leads in the Mittelstand, this may sound at first like a topic for security researchers in data centers, far removed from day-to-day business. That's a mistake. Anyone running an AI agent for customer service, quote generation, or internal research today should understand what this standard means, what it doesn't mean, and what questions it should prompt them to ask their own AI vendor now.

A rare show of unity among competitors

The announcement did not land on July 1, 2026 by accident. On that day, Anthropic re-enabled its cybersecurity model Claude Fable 5, after the US government had briefly imposed export controls on the particularly capable Fable and Mythos models. The background: Amazon had reported to the US Department of Commerce that Fable's safeguards could be bypassed - a jailbreak that occurred, of all places, in a model specifically built for offensive cybersecurity tasks such as detecting software vulnerabilities. At precisely this moment of uncertainty, Anthropic, Amazon, Google, and Microsoft proposed a shared vocabulary for the industry to use in emergencies.

This is remarkable because these companies compete openly on almost every other level - on model performance, on cloud infrastructure, on whose agent ecosystem wins out. That an industry-wide consensus rather than competitive behavior is emerging specifically around safety is a genuine novelty, and it's a credible argument to use with skeptical leadership teams: safety is increasingly becoming a competitive field in its own right, not just a compliance box to tick. When the biggest providers in the market publicly admit that their own flagship models could be bypassed, and derive a joint rating standard from that, it's a signal that jailbreaks are no longer a theoretical edge case, but a risk that operational processes need to plan for.

The CJS initiative is embedded in Project Glasswing, a program in which selected partners - initially around 50 organizations such as AWS, Google, Microsoft, Cisco, CrowdStrike, JPMorganChase, NVIDIA, Palo Alto Networks, Cloudflare, Mozilla, Apple, Broadcom, and the Linux Foundation, expanded in June 2026 by around 150 more organizations from 15 countries - gain access to Anthropic's especially capable model, Claude Mythos. Their mandate: find software vulnerabilities in critical infrastructure before attackers do. The new rating standard is thus not an isolated rulebook, but the safety-technical foundation of a much larger program that puts to productive use exactly the kind of vulnerabilities a jailbreak in the wrong hands would make dangerous.

For context, it's important that the CJS framework is, so far, explicitly a proposed, voluntary industry standard - not a legally anchored norm, and not a specification officially adopted by bodies like NIST or ISO. That doesn't necessarily diminish its practical value, but it shouldn't be glossed over when communicating with leadership or customers: anyone marketing "we align with industry-wide safety standards" today should be able to say precisely which standard that is and what binding character it actually carries.

How the CJS scale works

The Cyber Jailbreak Severity Scale distinguishes five levels: CJS-0 (Informational, no new attacker capabilities), CJS-1 (Low), CJS-2 (Medium), CJS-3 (High), and CJS-4 (Critical). One detail that's easy to miss is decisive here: the scale is meant to be exponential, not linear. Each level is supposed to be a multiple more critical than the one before - so a CJS-3 jailbreak isn't simply "somewhat more dangerous" than CJS-2, but potentially many times more severe in its possible impact. For context, it may help to compare this with severity systems from classic IT security, such as CVSS ratings for software vulnerabilities. That comparison, however, is ours for the purpose of framing it and is not a statement Anthropic itself has made.

Jailbreaks are assessed along four axes. First, Capability Gain: how far does a technique take an attacker beyond tools that are already freely available? Second, Breadth: how many different offensive tasks can the technique be applied to - is it a niche trick or a universal tool? Third, Ease of Weaponization: how much human effort is needed to turn the technique into a real attack? And fourth, Discoverability: how well-known or easily findable is the technique already - is it documented in relevant forums, or is it a previously unknown zero-day trick?

For the most severe category - jailbreaks actively used against critical infrastructure - Anthropic intends to roll out countermeasures immediately once the severity is confirmed. A team monitors the jailbreak reporting channels around the clock for this purpose. Companies and security researchers can send feedback on the framework to a dedicated email address and report jailbreaks through a bug bounty program on HackerOne. On the framework's actual objective, Anthropic can be quoted as follows:

"The goal is a standard that enables defensive use but prevents misuse." — Anthropic, on the objective of the CJS framework

This phrasing matters more than it might seem at first glance. It describes the balancing act every provider of capable AI systems faces: a model that helps security researchers find vulnerabilities can, in the wrong hands, use that very same capability to exploit them. A shared rating standard is meant to prevent that balancing act from being left to chance or to the competitive pressure of individual providers.

It's also interesting how quickly the circle of participating organizations has widened. From an initial roughly 50 partners in April 2026, the program has grown within two months to around 200 organizations from 15 countries. This growth rate suggests that participating companies are genuinely deriving operational value from the collaboration - a program that served public relations alone would hardly onboard new, sometimes competing, partners at this pace. For a Mittelstand business that isn't part of this exclusive circle and likely never will be, the important takeaway remains: the major cloud and security providers whose infrastructure many mid-sized IT systems already rely on are investing noticeably in exactly this question.

What Project Glasswing has already delivered in numbers

The figures published so far from Project Glasswing show how seriously the participating companies are taking this. Since its start in April 2026, according to Anthropic, over 10,000 high- or critical-severity vulnerabilities have been identified in critical software. Cloudflare reports around 2,000 bugs found, of which about 400 were rated High or Critical, with a false-positive rate that outperforms purely human testers. Mozilla reports 271 vulnerabilities found for Firefox - roughly ten times more than with the predecessor model. In a broader scan of open-source software, 23,019 potential vulnerabilities were flagged across more than 1,000 projects, of which 6,202 were rated High or Critical. Of 1,752 critical findings that Anthropic reviewed together with six independent security firms, over 90 percent were confirmed as genuine, validated hits.

These figures are relevant for two reasons, even though at first they sound like a pure success story out of Anthropic's press office. First, they show that the same model class that enables jailbreaks can, in controlled conditions, also deliver defensive impact at a scale that would be nearly unreachable through classic manual audits. Second - and this is where caution is warranted - practically all of these figures come from Anthropic itself, or from partners that Anthropic publicly cites. Independent third-party validation beyond the named partner firms is not yet available. That doesn't fundamentally diminish their significance, but it should be kept in mind before citing these figures internally as conclusive proof of safety.

The caveat buried in the fine print

Here's a point that gets lost in many of the shorter news pieces on this topic: the CJS framework was developed primarily in the context of Anthropic's offensive cybersecurity specialist models Fable and Mythos - models specifically trained to find vulnerabilities in software. It is not primarily intended for everyday customer service chatbots, internal assistants, or the kind of automation a mid-sized company typically has in use.

Applying it to ordinary business AI agents is therefore a reasonable analogy, not a direct claim made by the four companies involved. No one at Anthropic, Google, Amazon, or Microsoft has stated that any random chatbot will now be rated on the CJS scale. What does carry over, however, is the underlying principle: a systematic, traceable classification of security incidents, combined with a clearly defined response time for the most critical cases. This is exactly the principle you should demand from your own software and agent provider, even if they have no direct access to Fable or Mythos and never will.

The difference between "the standard applies to my system" and "my provider should also follow the principle behind the standard" is not a technicality. Whoever blurs that distinction is selling a safety promise that doesn't actually exist - and that ultimately damages trust in AI providers more than it helps.

Jailbreaks are already an operational risk, not an academic one

Anyone who believes jailbreaks are a niche problem for research labs should take a look at the success-rate figures. According to a study that could not be verified at the primary source but is widely cited, jailbreak attempts against generative AI succeed on average in roughly 20 percent of cases. For visual jailbreak attacks against multimodal AI systems, the same source claims success rates of up to 98.21 percent, and for creative attack formats - such as prompts phrased as poems - between 43 and 62 percent. These specific percentages should be treated with caution, since they could not be cross-checked against the cited primary source in this research. Still, the order of magnitude alone should raise an eyebrow: even conservatively estimated, a significant share of jailbreak attempts against current AI systems succeed - it's no rare exception.

The Open Web Application Security Project (OWASP) continues to list prompt injection and jailbreaking in its Top 10 for LLM applications as one of the biggest vulnerability classes in production systems. Important for the Mittelstand: this doesn't just affect chat interfaces, but explicitly also agents with tool access, RAG pipelines, model routers, and memory functions - exactly the kind of automation increasingly in use when a customer service bot is directly connected to the CRM, or an internal assistant is allowed to access contract databases.

A Kiteworks forecast for 2026 sharpens the picture further: it finds that 55 to 63 percent of companies lack adequate access and containment controls for their AI agents. In plain terms: even if the underlying language model is perfectly secured, a poorly configured agent with excessively broad permissions to customer data, payment information, or internal systems can become the actual point of entry. The CJS standard addresses the model layer. Access controls at the agent layer remain your own responsibility as the company deploying the agent - and that is precisely where a gap exists today at more than half of all businesses.

These access controls aren't an abstract IT topic - they're easy to picture with an everyday example: a customer service agent connected to a CRM system to look up order status or contract data generally has no need for write access to payment information or the ability to independently grant discounts. If such an agent is manipulated via a successful prompt injection attack into treating instructions from a manipulated customer inquiry or an embedded document as a legitimate system directive, it's exactly this permission boundary that determines whether the end result is a harmless glitch or real financial damage. The best base model in the world doesn't protect you from an agent that has more permissions than it needs for its actual job.

The timing overlap with the EU AI Act

The voluntary industry standard isn't landing by coincidence in a phase where regulators are also catching up. As of August 2, 2026, Article 50 of the EU AI Act becomes binding: transparency obligations that require companies to disclose when customers are interacting with an AI - for example, with a chatbot. This disclosure must be visible at the very first interaction, not buried somewhere in the terms and conditions. Violations carry fines of up to €15 million or 3 percent of global annual revenue - whichever is higher.

For your Mittelstand business, this creates a double obligation that reinforces itself. On one side stands the voluntary, but increasingly market-standard, expectation that AI system providers systematically classify security incidents and respond quickly. On the other side stands the legal obligation to make AI use transparent to your customers. Both, at their core, address the same question: how responsibly are you deploying a technology that - as the jailbreak numbers show - cannot be fully controlled? Thinking through both topics together now saves you double the rework later on documentation and disclosure.

What you should do now, concretely

Combining the voluntary industry standard with the statutory transparency obligation yields a clear action list for your business. First, before signing or renewing a contract with an AI agent provider, request written information about their jailbreak and incident response process - similar to the IT security and data protection audits already standard practice in many companies. Specifically, there are four questions you can ask any provider:

First: what process or scale does your provider use to classify and prioritize jailbreaks or security vulnerabilities? Second: is there a defined response time when a critical jailbreak or a bypass of safety measures becomes known, and who monitors that? Third: how, and how quickly, will you as a customer be informed if a security issue arises in the model or agent you're using? And fourth: what access and containment controls - permissions, data access, rate limits - does the agent have over your sensitive customer data, payment data, or internal systems, regardless of which base model underlies it?

In parallel, you should treat the disclosure requirement from Article 50 not as an annoying formality but as a project that's overdue anyway: chat widgets, automated email-response signatures, and phone menus with voice AI must make it clear that a customer is dealing with an AI system. Whoever implements this labeling cleanly now, instead of scrambling right before August 2, 2026, wins twice: legal certainty, and - because transparency demonstrably builds trust - a better relationship with their own customers.

Documentation benefits from a dual view too: if you already have to record, for Article 50 purposes, at which touchpoints your customers interact with AI systems, you can note in the same document which provider and which model you're using at that point, and what assurances that provider has made regarding jailbreak detection and response time. That turns two separate obligations - one regulatory, one self-imposed - into a single, maintainable register that can also serve as proof of diligent practice to regulators or insurers if needed.

In the end, a sober assessment remains: the CJS standard doesn't automatically protect your customer service bot just because four big names signed it. But it shows where the industry is heading - toward systematic, traceable assessment of AI safety risks instead of case-by-case reactions. If you demand this mindset from your own providers today, you'll be better protected tomorrow - and better prepared for the next tightening of regulation, which will certainly come.