Article
CommunityJev Guides & Articles
Pillar Security: the agent with no LLM inside
Pillar Security analyzes Jev and System One models: a smart-home demo answered three typed questions in about 200 ms with no language model in the loop, while prompt scanning, output filtering and chain-of-thought monitoring all have nothing to inspect. TypeSafe's docs say state is not treated as hostile by default.
- Format
- Article
- Reading time
- 3 min
- Published by
- Community
- Author
- Dor Sarig
- Last verified
- Oct 2026
Highlights
- In the lamp demo, Jev answered three typed questions in one response in roughly 200 ms, per the post.
- The demo ran on unmodified MCP servers: Home Assistant, Wikipedia, web search and unit conversion, with no LLM in the loop.
- Jev is trained with RLCD, Reinforcement Learning for Calibrated Decisions; it accepts text only, up to 32k tokens of state in a 64k request.
- TypeSafe's launch post claims 0% structured-output errors versus 0.58% to 45.5% for frontier LLMs, and 0% tool-call errors versus up to 17.0%.
- Pillar's read: Jev will never call a tool that does not exist, but it can call the wrong tool with perfect type safety.
Watch out
Copy reviewed against the published post on 2026-10-17; the digest text was truncated mid-post, so the closing recommendations were not fully readable. Pillar is a vendor selling AI security products, and the launch error-rate figures are TypeSafe's claims, which the post quotes with TypeSafe's own caveat that they are not empirical.
Questions about this entry
Short answers drawn from the linked project or page.
An AI model that returns typed decisions with calibrated probabilities instead of generated text: you give it application state and a fixed set of questions, and it answers all of them at once, so it can never produce a malformed answer.
A developer told a chatbot to turn off a lamp and it was off 300 milliseconds later with no LLM in the loop. The bot asked Jev three questions per turn: request or cancellation, which registered tool, and what arguments, pointed to as spans.
Prompt scanning, output filtering and chain-of-thought monitoring all assume an LLM call as their anchor. The lamp bot has no prompt in that sense, no generated output to filter and no chain of thought, so three of the industry's primary controls are absent.
The limitations page for jev-1.13 says state is data and is not treated as hostile by default, so content written to adversarially steer the model can move the answer. The suggested mitigation is to write precise criteria and test before deploying widely.
No. Schema matching guarantees the answer is inside the declared set but says nothing about whether it is right. The post puts it as: Jev will never call a tool that does not exist; it can call the wrong tool with perfect type safety.
A judge model produces text your parser must read, a classifier produces one label, and a System One model returns the decision surface of a workflow step, typed, in one call. Jev is listed at 70 to 500 ms hosted and runs only on TypeSafe's hosted API as of writing.
TypeSafe's concept page says calibration is measured across groups of predictions and does not guarantee that an individual answer is correct. The limitations page gives measured examples, such as a refund question scoring 0.22 as a Noul and 0.01 as a yes/no Choice.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsX: Jev and Laya on security queries
X: Testing Jev for prompt injection
More Jev resources like this
Rogue Security's post uses Jev and System One models to frame agentic security as a decision problem: the same send_file action should be allowed, blocked or reviewed depending on who requested it and where the data goes, illustrated with policy case files rather than product results.
Jev Guides & ArticlesArticle#community#press#security
Community
HiddenLayer researchers tested Jev and an in-house System One-style model: on a simulated checkout page an attacker-controlled ad made the browser agent click away from the purchase, and TokenBreak-style edits lowered toxicity scores for prompts both models had flagged.
Jev Guides & ArticlesArticle#community#press#security
Community
HiddenLayer's insight post walks security teams through its Jev tests: on a simulated checkout page Jev gave the attacker ad's button 91% against 9% for Place order, and TokenBreak edits cut one prompt's toxicity score by more than two thirds so Jev stopped flagging it.
Jev Guides & ArticlesArticle#community#press#security
Community
Ian Maurer's ThinkThen analysis argues Jev's faster and cheaper are measurable today while its better is a bet on RLCD: unlike RLHF, which pleases humans, and RLVR, which optimizes benchmarks, Jev is trained to be reliable for programmatic use, in Diogo Almeida's own framing.
Jev Guides & ArticlesArticle#community#press#explainer
Community
TWIML episode 779 features TypeSafe co-founder and CEO Diogo Almeida on Jev, the company's model for bringing fast, reliable intelligence directly into software, and why text-generating models are poorly suited to many real-world automation decisions.
Jev Guides & ArticlesArticle#community#press#podcast
Community
A LessWrong pilot testing Jev as a trusted monitor in the ControlArena APPS backdoor setting: one yes/no question reaches AUROC 0.976 and catches 90% of backdoors at a 2% false-positive rate for about $0.04 per thousand submissions.
Jev Guides & ArticlesArticle#community#press#security
Community
From the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.