--- type: Blog Post title: "AI Agent Jailbreak Risk: Set Severity Levels Before You Automate" description: AI agent jailbreaks are now a workflow risk. Learn how SMBs set severity levels, permissions, review logs and response plans before automation expands safely. resource: https://www.rxai.com.au/blog/2026-07-02-ai-agent-jailbreak-risk-severity-levels.html tags: [AI Agents, AI Governance, Automation, Jailbreak Risk, Human Review, Incident Response] timestamp: 2026-07-02T09:00:00+10:00 category: Automation source_package: /Volumes/ExternalSSD/MacMiniDocuments/rxai_social_posts/2026-07-02_ai-jailbreak-severity-framework source_checked: 2026-07-02 --- AI jailbreak incidents are no longer only a frontier-model problem. For SMBs deploying agents, the practical step is to define severity levels, permissions, review points and response plans before automation expands. ## Why Does Jailbreak Severity Matter for SMBs? Anthropic's 1 July 2026 redeployment note is useful because it treats jailbreak incidents as a severity and response problem, not just a model news item. SMBs may not run frontier cyber evaluations, but they are connecting AI agents to customer support, sales, finance administration, reporting and content workflows. The practical question is whether a weak, manipulated or unauthorised answer can trigger an action: sending a message, changing a CRM field, exposing private data, deleting a record, approving a refund or making a public commitment. > RxAI insight: When AI agents move from drafting to acting, the control model needs to change. Severity levels, permissions, logs and pause rules should be designed before automation expands. > Risk lens: a low-quality draft is a content issue. A manipulated agent with write access is an operations issue. Treat those as different severity levels before the workflow goes live. ## What Did the Sources Confirm? Anthropic said it is working with Amazon, Microsoft, Google and other Project Glasswing partners on a consensus framework for scoring AI jailbreak severity and developer response. CNAS separately argues that jailbreak incidents vary in seriousness and need predictable, institutionalised assessment rather than ad hoc reaction. Anthropic's Project Glasswing updates add another useful lesson: AI can help accelerate vulnerability discovery, but triage, verification, disclosure, patching and deployment remain process work. Source-backed metric: Anthropic reported more than 10,000 high- or critical-severity vulnerabilities across Project Glasswing partners in its May 2026 update. ## How Should You Classify Agent Risk? - **Low risk:** drafting, summarising, tagging, idea generation and internal notes where a person reviews before anything is published or actioned. - **Medium risk:** customer-facing drafts, CRM updates, lead scoring, support triage and reporting where incorrect output can waste time or create confusion. - **High risk:** payments, contracts, legal or medical content, cyber changes, personal data, bulk outbound messaging, deletion, account changes and external commitments. ## What Permissions Should Agents Have First? Start with read-only or recommendation-only workflows unless there is a clear reason to do more. An agent that can read a document library does not automatically need permission to edit it. An agent that drafts a reply does not need permission to send it. The permission model should follow the severity level. Low-risk tasks can move faster. Medium-risk tasks need review and logging. High-risk tasks need explicit approval, role-based access, reversible actions where possible and a named incident owner. ## What Should an Agent Incident Plan Include? 1. **Pause:** define who can disable the agent, revoke tool access or stop outbound actions. 2. **Trace:** keep logs of inputs, outputs, source documents, tool calls, reviewer approvals and final actions. 3. **Assess:** classify the incident as low, medium or high severity based on data exposure, customer impact, financial impact and operational reversibility. 4. **Notify:** decide who must be told internally and when customers, vendors or regulators may need communication. 5. **Repair:** fix the prompt, tool permission, retrieval source, approval step or business process that allowed the failure. ## What Should Business Leaders Do Next? Do not begin with the question, "Which agent platform should we buy?" Begin with the workflow. List the actions the agent may take, what can go wrong, who reviews each step and how the business would recover if the output is wrong or manipulated. RxAI helps Australian businesses design AI automation with practical permissions, review points and governance. Start with [AI automation and consulting services](../services.html) or book a short discussion through the [contact page](../contact.html). ## Sources - [Anthropic - Redeploying Claude Fable 5](https://www.anthropic.com/news/redeploying-fable-5) - [Anthropic - Project Glasswing: An initial update](https://www.anthropic.com/news/glasswing-initial-update) - [Anthropic - Expanding Project Glasswing](https://www.anthropic.com/news/expanding-project-glasswing) - [CNAS - Governing Jailbreak Incidents](https://www.cnas.org/publications/cnas-insights/cnas-insights-governing-jailbreak-incidents) - [Ars Technica - After spooking Trump into safety testing, Anthropic AI models get global release](https://arstechnica.com/tech-policy/2026/07/after-spooking-trump-into-safety-testing-anthropic-ai-models-get-global-release/) ## Frequently Asked Questions ### What is an AI jailbreak? An AI jailbreak is an attempt to bypass or weaken a model or agent rule so it produces output or takes action that should normally be blocked. For businesses, the concern increases when an agent has access to tools, data or external actions. ### Why should SMBs care about jailbreak severity? SMBs are increasingly connecting AI to real workflows. A weak draft and an unauthorised data change should not be treated as the same severity. Clear risk levels help teams decide when human approval, logging and incident response are required. ### Should an AI agent have write access from day one? Usually no. The safer starting point is read-only or recommendation-only access. Add write permissions only after the workflow has logs, review points, rollback options and an agreed severity model. ### What is the simplest AI agent risk framework? Use low, medium and high risk tiers. Low risk covers internal drafting and summaries. Medium risk covers customer-facing or operational recommendations. High risk covers money, personal data, legal commitments, cyber changes, deletion and bulk outbound actions.