Jev Decision Models Remain Vulnerable to Indirect Prompt Injection Attacks
System One decision models share fundamental security risks with traditional autoregressive language models.
1Challenging Deterministic Claims
TypeSafe AI claims its Jev decision model avoids hallucinations and type errors by returning probabilities instead of text. However, security firm HiddenLayer evaluated these System One models to determine if they truly resist manipulation. Their findings suggest that these models remain susceptible to the same indirect prompt injection vulnerabilities as standard LLMs.
2Underlying Architectural Realities
HiddenLayer researchers argue that System One models are essentially LLMs utilizing a different decoding strategy. Because they function as language models under the hood, they inherit the same inherent risks as autoregressive models. The inability to output arbitrary tokens does not provide a complete security shield against sophisticated adversarial prompt manipulation attempts.
3Simulated Browser Agent Testing
Researchers tested Jev and a Qwen3.8-27B model using a simulated online store environment. The agent was instructed to purchase items without modifying the cart contents. The system prompt explicitly defined page text as untrusted data. Despite these constraints, the agent was tasked with navigating checkout processes while facing potential malicious inputs.
4Clickjacking Through Malicious Prompts
The team injected a sponsored ad featuring a fake 'Confirm Price' button into the simulated web page. The browser agent, instead of following its primary checkout instructions, clicked the malicious button. This attack successfully diverted the agent from its intended path, proving that decision models can be manipulated into performing unauthorized system actions.
5Comparative Vulnerability Analysis
Both the Jev model and the Qwen-based decision model succumbed to the injection attacks during testing. While Jev exhibited a slightly higher resistance, it was not immune to the exploit. Researchers consistently stole the model’s click action by pretending an additional task was required before the checkout process could be successfully completed.
6Escalation of Attack Vectors
HiddenLayer warns that chaining these attacks across multiple web pages could grant an attacker full control over a browser agent. By repeatedly inserting malicious prompts, adversaries can effectively hijack the decision-making process. This demonstrates that the vulnerability is not model-specific but rather a systemic issue inherent to current language model architectures.
7Prompt Verification Bypass Risks
Jev is often marketed for prompt verification tasks, but researchers found this application also faces security gaps. They successfully used a tokenbreak attack, adding extra characters to prompts to evade classifiers. This allowed toxic prompts to bypass the verification process, further highlighting that decision models are not inherently safer than text-emitting counterparts.
8Implications for System Integration
The core takeaway is that any model returning a decision remains a language model at its foundation. When these decisions trigger automated actions within sensitive systems, the risk of exploitation becomes significant. Developers must approach these models with caution, acknowledging that architectural changes do not eliminate the fundamental risks of prompt injection.