MLCommons has launched two on-demand benchmarks for testing how AI systems handle harmful requests and jailbreak attacks, alongside results for 27 systems. Developers can run the tests against their own deployed systems through its new Candela service, turning safety checks into something teams can measure on their own setup rather than admire from a distance.
MLCommons Watch analysis
What happened
AILuminate Safety 1.2.1 measures whether a text-based system refuses or safely redirects harmful requests across 12 hazard categories, including violence, privacy, hate and specialised health, legal and financial advice. Jailbreak 1.1 tests whether known attack techniques can push a system into responses it would not give to a plain request.
MLCommons has also published results for 27 systems: 22 open-weight models and five guardrail systems. It says the open-weight models range from the 4th to the 98th percentile on its reference scale. The organisation says the guardrail systems scored at or near 100. Public results for Jailbreak 1.1 are still to come, after a notification period for developers.
The new benchmarks use a deterministic classifier trained for this evaluation, replacing language models as judges. MLCommons says the change improves agreement with human judgement and cuts Safety test time from about three hours to one.
Why it matters
A model’s safety can look different when it is deployed with its own system prompt, guardrails and retrieval tools. Candela is designed to test that deployed configuration: a client relays prompts to the system and returns its answers for evaluation. MLCommons says the client does not send keys, model weights or configuration details.
That makes the results potentially more useful to teams choosing or tuning a system than a score detached from its deployment. The percentile scale also gives buyers a comparison against a fixed reference set. Still, a benchmark score is a measure of performance on that benchmark, not a safety certificate for every real-world situation.
Our read
This is a practical step towards testing the system people actually put in front of users, including the safeguards wrapped around the model. The most welcome change may be the move away from LLM judges: if the evaluator can give consistent verdicts and be checked against human assessments, the score has a sturdier footing. The sensible move for teams is to treat the results as one useful test, not the whole safety case.
What to watch
- When MLCommons publishes Jailbreak 1.1 results and which systems are included.
- Whether organisations use Candela to publish comparable results for deployed systems.
- How the deterministic evaluator performs as MLCommons adds more human-judged examples.
Discussion spark: Should buyers require a published jailbreak score before deploying an AI system, or would that risk turning one benchmark into a misleading pass mark?
Sources and evidence
- Test Your Own AI Against Real-World Risks and Attacks with AILuminate Safety 1.2.1 and Jailbreak 1.1 (29 October 2026, 14:45 UTC)
Independent WittyWires tracker for public updates about MLCommons. Not affiliated with or endorsed by MLCommons; this is not an official account.