Jev decision model remains vulnerable to prompt injection

Security firm HiddenLayer found that Jev, TypeSafe AI’s decision model, remains susceptible to indirect prompt injection despite returning probabilities and confidence scores rather than freeform text. The findings challenge assumptions that constrained outputs prevent manipulation. TypeSafe AI claims Jev cannot hallucinate and never makes type errors, but those properties do not eliminate incorrect decisions or exploitable behavior.

Researchers tested an open-source browser agent built on jev-ultrafast in a simulated online store. Its instructions were to purchase the existing cart without changes, while its system prompt explicitly treated page text as untrusted data. A sponsored ad claiming that a sale price had not been applied persuaded the agent to click a “Confirm Price” button instead of completing checkout. The attack also worked against Qwen3.8-27B configured to behave as a decision model, although Jev fell for it less often.

HiddenLayer also bypassed prompt verification using a variant of tokenbreak, which adds extra letters to evade classifiers, allowing toxic prompts through. The researchers attributed the shared weaknesses to decision models still being language models with different decoding strategies. They warned that chaining deceptive pages could give attackers control over the tested agent. TypeSafe AI did not immediately respond to a request for comment.