Article
CommunityJev Guides & Articles
HiddenLayer: Jevil in the details - System One model security
HiddenLayer researchers tested Jev and an in-house System One-style model: on a simulated checkout page an attacker-controlled ad made the browser agent click away from the purchase, and TokenBreak-style edits lowered toxicity scores for prompts both models had flagged.
- Format
- Article
- Reading time
- 2 min
- Published by
- Community
- Author
- Kenneth Yeung and Kasimir Schulz
- Last verified
- Oct 2026
Highlights
- An attacker-controlled ad on a simulated checkout page made the browser agent click away from the purchase despite instructions to treat page text as untrusted.
- Targeted TokenBreak-style character edits lowered toxicity scores for prompts both Jev and the test model had initially flagged.
- The browser attack also worked against the conventional, text-generating version of HiddenLayer's in-house model.
- TypeSafe claims Jev offers up to 193x speed and 444x cost advantages over conventional LLM workflows, per the post.
- HiddenLayer built its test model by converting Qwen3.8:27b and removing the normal decode process; Jev's exact architecture has not been disclosed.
Watch out
Copy reviewed against the published research post on 2026-10-17; the digest text was truncated mid-post, so later sections were not fully readable. This is vendor-authored security research by HiddenLayer, which sells AI security products, and Jev is a closed API tested black-box: the comparative model is HiddenLayer's own conversion rather than Jev's internals.
Questions about this entry
Short answers drawn from the linked project or page.
The team wanted to know whether a model that returns structured decisions resists manipulation better than one that returns text, so it tested Jev and an in-house System One-style model in two scenarios: a browser checkout task and a toxicity classification task.
On a simulated checkout page, an attacker-controlled advertisement caused the browser agent to click away from the user's purchase even though its instructions said to treat page text as untrusted.
Both models initially flagged prompts they were given, but targeted TokenBreak-style edits, which add characters so tokenizers split words differently while the meaning survives, lowered toxicity scores for prompts both models had flagged.
Yes. HiddenLayer says it also observed the browser attack against the conventional, text-generating version of its in-house model, which suggests the issue is not unique to the decision-making interface.
The post notes TypeSafe claims up to 193 times faster and 444 times cheaper than conventional LLM workflows, along with predictable outputs, long-context support, and answering multiple questions about the same information in one request.
It reconstructed a workflow that transforms a model into a System One model by swapping out the normal decode process, reducing latency to prefill time and adding modifications to reduce positional bias. A converted Qwen3.8:27b served as a local analog for tests.
That a faster decision interface does not remove the need to secure the decisions made through it. System One models are still LLMs under the hood, so adversarial text and prompt injection can disrupt their outputs, sometimes more easily.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsX: Jev and Laya on security queries
X: Testing Jev for prompt injection
More Jev resources like this
HiddenLayer's insight post walks security teams through its Jev tests: on a simulated checkout page Jev gave the attacker ad's button 91% against 9% for Place order, and TokenBreak edits cut one prompt's toxicity score by more than two thirds so Jev stopped flagging it.
Jev Guides & ArticlesArticle#community#press#security
Community
Pillar Security analyzes Jev and System One models: a smart-home demo answered three typed questions in about 200 ms with no language model in the loop, while prompt scanning, output filtering and chain-of-thought monitoring all have nothing to inspect. TypeSafe's docs say state is not treated as hostile by default.
Jev Guides & ArticlesArticle#community#press#security
Community
Rogue Security's post uses Jev and System One models to frame agentic security as a decision problem: the same send_file action should be allowed, blocked or reviewed depending on who requested it and where the data goes, illustrated with policy case files rather than product results.
Jev Guides & ArticlesArticle#community#press#security
Community
VentureBeat's Louis Columbus reports Jev is spreading into agent infrastructure faster than enterprises can audit it. In one Octomind test a planted field cut a block probability from 0.76 to 0.48, and TypeSafe and Pydantic both warn inputs can steer answers.
Jev Guides & ArticlesArticle#community#press#security
Community
A LessWrong pilot testing Jev as a trusted monitor in the ControlArena APPS backdoor setting: one yes/no question reaches AUROC 0.976 and catches 90% of backdoors at a 2% false-positive rate for about $0.04 per thousand submissions.
Jev Guides & ArticlesArticle#community#press#security
Community
Hacker News link to SafeDep's write-up on Gryph telemetry plus narrow Jev yes/no checks against developer policy.
Jev Guides & ArticlesPost#community#security#agents
Community
From the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.