Not Every AI Failure Is a Crisis: Scoring Risk by Real-World Harm

For nineteen days this summer, one of the most capable AI models in the world went dark.

On June 12, 2026, the US government applied export controls to Claude Fable 5 and Claude Mythos 5, cutting off access for users everywhere while officials and the company that built the models worked out how much real-world risk it actually posed. Access came back on July 1. In between, Anthropic shipped a new safety classifier and published testing that reframed how much the original finding actually mattered.

The trigger was a technique Amazon researchers found that got Fable 5 to identify software vulnerabilities and, in one case, produce code demonstrating how one of them could be exploited. That sounds alarming on its face. Then Anthropic ran the same prompts against other models and reported that every model it tested could produce the same demonstration, including ones as small as Claude Haiku 4.5.

So the whole episode turned on a question nobody had a shared way to answer: how dangerous was it, really?

That’s the question we want you to sit with, because your team faces a smaller version of it regularly. An AI tool does something it wasn’t supposed to do. Someone gets it to produce output it should have refused. A model surfaces information you didn’t expect it to have. In the moment, you have to decide whether you’re looking at a shrug or a fire.

Most teams don’t have a good way to tell the difference. That’s the gap we want to close.

I’m Kate Waldhauser, founder of Violet Beacon. We help organizations build AI governance that’s sized to the actual risk, and sizing the risk is where it starts.

Why does pass-or-fail thinking fail us?

Here’s how AI incidents usually get handled. Something goes wrong, and the response is one of two things. Either “it’s fine, that’s just how these tools are,” or “shut it down, we can’t trust it.” Pass or fail. Green or red.

Both reactions feel responsible. Neither one is governance.

A pure pass/fail mindset over-reacts to harmless quirks, burning a week and a lot of goodwill treating a cosmetic glitch like a breach. It also under-reacts to the genuinely risky ones, because when most alarms turn out to be nothing, people stop listening to the alarm. You end up with a team that’s anxious and numb at the same time, which is the worst of both.

What’s missing is proportion: a way to say “this happened, and here’s how much it actually matters,” with reasoning you could defend to a client, an auditor, or your own leadership.

What four questions actually size an AI risk?

Frontier labs, facing this same problem at much higher stakes, landed on a set of questions worth borrowing. On July 2, 2026, Anthropic published them as a draft Cyber Jailbreak Severity (CJS) scale, developed with its Project Glasswing partners. The CJS scale is a shared rubric for rating how dangerous a given jailbreak actually is, rather than simply noting that one happened. When something bypasses an AI system’s guardrails, you score it on four axes:

Score those four and “an AI did something weird” becomes a rated risk with defensible reasoning behind it. It’s the same move the software security world made years ago with CVSS. Nobody says “there’s a vulnerability” and stops there. They say how severe it is, along which dimensions, and everyone knows roughly what the number means.

Worth noting what the labs left out. The scale covers cybersecurity jailbreaks only, and Anthropic explicitly excludes things like getting a model to reveal its system prompt. Anthropic also calls it “an early draft.” Reading it, we’d add that it doesn’t yet say who arbitrates when two companies score the same failure differently. We’re pointing at the logic here, not holding the document up as a settled standard.

Why isn’t “bypassed” the same as “dangerous”?

Look back at what actually got that model suspended. The behavior turned out to be reproducible across models already in wide public use. The guardrail was bypassed, and the capability behind it wasn’t unique, wasn’t hard to find elsewhere, and mostly amounted to work that defenders do every day.

Walk it across the four axes and a shape appears.

One axis runs high and the total still lands low. That’s the whole point: discoverability alone doesn’t make something dangerous when the capability was already sitting in every free model. “A bypass exists” and “this is dangerous” are two separate findings, and collapsing them into one is how a useful model ended up offline for nineteen days.

For your team, the translation is direct. When an AI tool does something off-script, start somewhere other than whether it broke a rule. Ask how far someone could actually get with it, and how easily. That’s the question that tells you whether you’re looking at a note-to-self or an all-hands.

Where does this already live in ISO 42001 and the NIST AI RMF?

If you’ve done any work toward ISO/IEC 42001 or the NIST AI Risk Management Framework, this should feel familiar.

The AI RMF’s Measure function, described in Section 5.3, exists to “analyze, assess, benchmark, and monitor AI risk and related impacts,” and it asks for metrics on trustworthy characteristics and social impact. A bare pass or fail doesn’t satisfy that. ISO 42001 clause 6.1.2 asks for an AI risk assessment that weighs likelihood and impact against your own risk criteria, which means sizing a risk before you decide how to treat it. A four-axis severity score gives you concrete vocabulary for something those standards already require. It adds precision rather than paperwork.

That reframe is worth holding onto, because “responsible AI” can start to sound like an endless list of new burdens. A lot of it is just doing, deliberately and on paper, the sizing-up that good teams already do in their heads.

How do you put a severity scale to work without a frontier lab?

You don’t need a frontier lab’s resources to use the logic. Here’s the lightweight version.

Add a severity field to your AI risk register with a simple rubric, even a 1-to-5 scale anchored to the four axes. Decide in advance who scores an incident, who reviews that score, and what each tier triggers. When something comes up, someone scores it, writes down why, and the score maps to a response tier.

Tie each band to a response you’ve agreed on in advance:

That last column is the part teams skip. An escalation path you write during an incident is a guess, and a guess made under time pressure is the thing you’ll defend least well afterward.

The number matters less than what it does to the conversation. Once a score exists, the question shifts from “should we panic” to “where does this land, and what does that tier call for.” That’s a calmer, faster, more defensible place to make decisions from.

If you want a way to start this week, take one AI incident your team has already handled and score it retroactively. The places where two people disagree are exactly where your rubric needs sharpening.

What does proportion actually ask of you?

Responsible AI comes down to proportion: the discipline of asking how much something actually matters before you decide what to do about it. That sits between panic and complacency, and it asks more of you than either one.

A severity scale is how you make that discipline real, repeatable, and visible to someone who wasn’t in the room. The frontier labs needed a shared vocabulary because they have to explain themselves to governments. You need one because you have to explain yourself to clients, auditors, and your own team, usually under time pressure and usually without much warning.

If you’d like a starting rubric you can drop into your own AI risk register, that’s exactly the kind of thing Violet Beacon’s Responsible AI Guidelines are built to give you.

Key References

• Anthropic, Redeploying Claude Fable 5, July 1, 2026. Suspension and restoration dates, and the cross-model reproducibility testing.
• Anthropic, More details on Fable 5’s cyber safeguards and our jailbreak framework, July 2, 2026. The Cyber Jailbreak Severity scale, its four axes, and its stated scope and draft status.
• Anthropic, Project Glasswing. The partner consortium the framework was drafted with.
• The Hacker News, “Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls”, July 2026. Independent reporting on the export-control order and the new classifier.
• ISO/IEC 42001:2023, clause 6.1.2 (AI risk assessment). Standard overview.
• NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), Section 5.3, Measure.
• FIRST, Common Vulnerability Scoring System.