Article
CommunityJev Media & Talks
The Register: decision models still fall to prompt injection
The Register covers HiddenLayer's tests of Jev and a decision-tuned Qwen model: a planted ad stole a browser agent's click on a simulated store page, and tokenbreak edits snuck toxic prompts past verification. TypeSafe did not immediately respond.
- Format
- Article
- Reading time
- 2 min
- Published by
- Community
- Author
- Thomas Claburn
- Last verified
- Oct 2026
Used inJev for Security & Privacy
Highlights
- The Register: decision models answer with probabilities and a confidence score, yet can still be exploited through indirect prompt injection.
- In HiddenLayer's simulated store, a sponsored ad's Confirm Price button consistently stole the agent's click action.
- The injection worked on Jev and on Qwen3.8-27B tuned as a decision model, though Jev succumbed less often.
- HiddenLayer: System One models are, under the hood, LLMs, simply using a different decoding strategy.
- TypeSafe AI did not immediately respond to a request for comment, the article notes.
Watch out
Copy reviewed against the published article on 2026-10-17. The tests are HiddenLayer's, a security vendor that sells AI security products; the piece reports simulated scenarios, and TypeSafe's response is unrecorded.
Questions about this entry
Short answers drawn from the linked project or page.
That some of the excitement about decision models follows from TypeSafe's claim that Jev cannot hallucinate and never makes type errors, yet these models can still get things wrong and be exploited through indirect prompt injection.
It evaluated whether Jev, which TypeSafe refers to as a System One model, resists manipulation better than a text-emitting LLM, using Jev and Qwen3.8-27B tuned to act like a decision model.
Researchers built a store with a saved card and a Place order button, instructed a browser agent to buy the cart contents and not follow page text, then added a sponsored ad whose Confirm Price button made the agent click away from the purchase.
Yes. The injection worked on the Qwen model as well as Jev, although Jev succumbed less often, and the researchers contend that anything capable of fooling an LLM can dupe its System One counterparts.
Prompt verification, one of Jev's suggested applications: researchers applied a variant of the tokenbreak attack, which adds extra letters to evade classifiers, to sneak toxic prompts through the verification process.
That System One models still face many of the same risks as autoregressive models because they are under the hood LLMs using a different decoding strategy: a model that returns a decision is still a language model, and its decision still becomes an action.
It says the vulnerabilities do not erase the potential cost and performance advantages of a model that returns decision probabilities instead of a text answer, but they suggest approaching decision models with caution.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
YouTube: Kubernetes admission control with a decision model, fail-closed.
Hacker News: SafeDep Gryph plus Jev checks for compromised coding-agent behavior.
2 pointsDetecting Compromised AI Coding Agents with Jev and GryphRead the thread on Hacker NewsX: Jev and Laya on security queries
X: Testing Jev for prompt injection
More Jev resources like this
InfoWorld covers a HiddenLayer report finding Jev more vulnerable than traditional LLMs to adversarial text and prompt injection, with analysts calling the methodology sound but debating whether flaw reports this early are premature.
Jev Media & TalksArticle#community#press#security
Community
The Injection's brief on HiddenLayer's tests: a browser agent powered by jev-ultrafast followed instructions planted in a web page and picked an attacker's ad over the real checkout button, and TokenBreak edits let toxic prompts slip past Jev's scoring. The post records no fix or response from TypeSafe.
Jev Media & TalksArticle#community#press#security
Community
VentureBeat's Louis Columbus reports Jev is spreading into agent infrastructure faster than enterprises can audit it. In one Octomind test a planted field cut a block probability from 0.76 to 0.48, and TypeSafe and Pydantic both warn inputs can steer answers.
Jev Guides & ArticlesArticle#community#press#security
Community
A Spanish-language analysis of Jev's five-day rise to critical infrastructure, the documented injection finding that moved a block verdict, and the six controls it says to add before production.
Jev Media & TalksArticle#community#press#security
Community
Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.
Jev Tools & CLIs#community#security#agent-skills
Community
cisco-ai-defense/skill-scannerPython
cisco-ai-defense/skill-scannerPythonPython CLI and agent skill that reviews Agent Skills, MCP configs, and source code for suspicious behavior with TypeSafe Jev plus local static checks, reporting file and line evidence, risk categories, model probabilities, and unscanned scope.
Jev Tools & CLIs#community#catalog-import#logicrw
Community
win4r/jev-security-scanPython
win4r/jev-security-scanPythonFrom the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.