Article
CommunityJev Media & Talks
The Injection: a planted ad derails TypeSafe's Jev
The Injection's brief on HiddenLayer's tests: a browser agent powered by jev-ultrafast followed instructions planted in a web page and picked an attacker's ad over the real checkout button, and TokenBreak edits let toxic prompts slip past Jev's scoring. The post records no fix or response from TypeSafe.
- Format
- Article
- Reading time
- 3 min
- Published by
- Community
- Author
- Kenneth Yeung and Kasimir Schulz
- Last verified
- Oct 2026
Highlights
- HiddenLayer's jev-ultrafast harness lists interactive elements; a planted ad made the agent choose it although page text was marked untrusted.
- Jev through TypeSafe's API and OpenAI's GPT-6 Luna through the Decisions API both made the attacker's choice; GPT-6 Luna less consistently.
- TokenBreak adds characters so tokenizers split words differently while meaning survives; it raised attack success on many toxic prompts.
- Classifier baseline in the case file: 30 of 30 toxic prompts flagged before the TokenBreak edits.
- The case file lists no vendor response, and the post says there is no patch to install because it describes a weakness, not a versioned software bug.
Watch out
Copy reviewed against the published item on 2026-10-17. The Injection is a news site summarizing HiddenLayer's research rather than an independent test; the underlying results come from HiddenLayer, which sells security products, and the post records no response or fix from TypeSafe.
Questions about this entry
Short answers drawn from the linked project or page.
It summarizes HiddenLayer's October 14, 2026 tests showing that TypeSafe's Jev and other System One models follow instructions planted in untrusted web pages and evade their own toxicity scoring under TokenBreak-style edits.
The jev-ultrafast harness turns a web page into a numbered list of interactive elements and asks the model which to pick. An attacker-controlled ad told the agent to finish another task before checkout, and the model selected the ad even though its system prompt marked page text as untrusted.
Jev reached through TypeSafe's API and OpenAI's GPT-6 Luna through the Decisions API both made the attacker's choice, GPT-6 Luna less consistently. HiddenLayer saw the same behavior in its own System One model built on Qwen3.8-27b and in that model's conventional variant.
The post records no fix and no response from TypeSafe. It describes a weakness in how System One models weigh untrusted page text rather than a software bug with a version number, so there is nothing for users to install.
No. Kenneth Yeung and Kasimir Schulz state that using a System One model does not automatically negate the risk of prompt injection, and they advise treating the whole decoder class with caution.
TokenBreak, published by HiddenLayer in June 2025, bypassed text classifiers by adding characters so tokenizers split words differently while meaning survived. On Jev, single character insertions achieved little, but more numerous, better-targeted perturbations raised attack success across many prompts.
Test these models inside the application that will use them, including against untrusted web pages and inputs reworded to keep their meaning while changing form; monitor the decisions and scores returned; and put independent checks around outcomes that matter.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsX: Jev and Laya on security queries
X: Testing Jev for prompt injection
More Jev resources like this
InfoWorld covers a HiddenLayer report finding Jev more vulnerable than traditional LLMs to adversarial text and prompt injection, with analysts calling the methodology sound but debating whether flaw reports this early are premature.
Jev Media & TalksArticle#community#press#security
Community
The Register covers HiddenLayer's tests of Jev and a decision-tuned Qwen model: a planted ad stole a browser agent's click on a simulated store page, and tokenbreak edits snuck toxic prompts past verification. TypeSafe did not immediately respond.
Jev Media & TalksArticle#community#press#security
Community
A Spanish-language analysis of Jev's five-day rise to critical infrastructure, the documented injection finding that moved a block verdict, and the six controls it says to add before production.
Jev Media & TalksArticle#community#press#security
Community
HiddenLayer researchers tested Jev and an in-house System One-style model: on a simulated checkout page an attacker-controlled ad made the browser agent click away from the purchase, and TokenBreak-style edits lowered toxicity scores for prompts both models had flagged.
Jev Guides & ArticlesArticle#community#press#security
Community
HiddenLayer's insight post walks security teams through its Jev tests: on a simulated checkout page Jev gave the attacker ad's button 91% against 9% for Place order, and TokenBreak edits cut one prompt's toxicity score by more than two thirds so Jev stopped flagging it.
Jev Guides & ArticlesArticle#community#press#security
Community
Business Insider's Stephen Council reports from a Jev hackathon at CodeRabbit's office, where developers said they had woven the model into agents and search tools. The piece cites nearly 40 million launch video views and a Discord server past 100,000 members.
Jev Media & TalksArticle#community#press#adoption
Community
From the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.