# Jev Decision Models Remain Vulnerable to Indirect Prompt Injection Attacks System One decision models share fundamental security risks with traditional autoregressive language models. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/66504473-facc-4c9b-82d9-9680c646d425 ## The Illusion of Safety TypeSafe AI claims its Jev decision model avoids hallucinations and type errors by returning probabilities instead of freeform text. However, security firm HiddenLayer recently evaluated Jev to determine if this System One architecture offers superior resistance to manipulation. The findings suggest that these models remain susceptible to the same vulnerabilities as standard LLMs. ## Shared Architectural Foundations HiddenLayer researchers argue that Jev and similar models are essentially LLMs utilizing a different decoding strategy. Despite their inability to output arbitrary tokens, they inherit the core risks of autoregressive models. This fundamental similarity means that security measures designed for traditional text-emitting models may not be sufficient for decision-based systems. ## Simulated Browser Agent Testing To test resilience, researchers compared Jev against a Qwen3.8-27B model tuned for decision-making. They built a simulated online store with a pre-configured cart and shipping details. The agent received strict instructions to complete the purchase without modifying the cart, providing a controlled environment to observe how models respond to external web page inputs. ## Clickjacking via Prompt Injection The team injected a malicious sponsored ad into the store page, prompting the agent to click a 'Confirm Price' button instead of finalizing the order. Both Jev and the Qwen model succumbed to this indirect prompt injection. While Jev performed slightly better, it still failed to ignore the untrusted data presented on the page. ## Escalation of Attacker Control By simulating additional tasks required before checkout, researchers consistently hijacked the model’s click actions. Chaining these attacks across multiple pages could grant an attacker full control over the browser agent. This demonstrates that even models designed for specific decision outputs can be manipulated to perform unauthorized actions within integrated system environments. ## Prompt Verification Bypass HiddenLayer also tested Jev's utility in prompt verification, a key suggested application for the model. They successfully applied a tokenbreak attack, adding extra characters to prompts to evade classifiers. This allowed toxic prompts to bypass the verification process, further proving that decision models do not inherently solve the challenges of prompt security. ## Universal Vulnerability Patterns The research concludes that these security flaws are not specific to Jev but are inherent to the underlying language model technology. Any system capable of deceiving a standard LLM is likely to compromise a System One counterpart. This indicates that decision-based models require robust security layers beyond their internal probability-based decoding mechanisms. ## Implications for System Integration The core takeaway is that a model returning a decision is still a language model, and its output directly triggers actions in connected systems. Developers must approach these models with caution, acknowledging that decision probabilities do not eliminate the risks of prompt injection. Security protocols must account for the model's susceptibility to external data. ## Sources covering this story - https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be-tricked-with-prompt-injection/5303184 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._