Research
Jev and other decision models can still be tricked with prompt injection
First reported theregister.com
Page published
Earliest dated coverage: 15 Oct 2026 · First observed: 15 Oct 2026 · Latest dated coverage: 15 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Decision models marketed as safer alternatives to text-emitting LLMs still inherit the same indirect-prompt-injection weaknesses, so defenders cannot assume this architecture resists manipulation when deployed as a browser agent.
HiddenLayer researchers evaluated TypeSafe AI's Jev decision model (a 'System One' model that outputs decision probabilities rather than freeform text) and found it remains vulnerable to indirect prompt injection despite claims it cannot hallucinate or make type errors. In a simulated online store, a browser agent built on jev-ultrafast was diverted by a sponsored ad with a 'Confirm Price' button, clicking it instead of following instructions; the same injection worked against a Qwen model tuned to behave as a decision model.