HiddenLayer shows TypeSafe AI's Jev decision model can be hijacked via indirect prompt injection and TokenBreak
HiddenLayer researchers evaluated TypeSafe AI's Jev "System One" decision model, which returns probabilities and a confidence score instead of freeform text. They found it remains vulnerable to indirect prompt injection, contradicting claims that it cannot hallucinate or make type errors. Jev was manipulated into a clickjacking-style action in a simulated browser-agent scenario, though it failed less often than a comparable text-emitting LLM. A TokenBreak variant also let toxic prompts slip past Jev when it was used for prompt verification. HiddenLayer argues these models are LLMs with a different decoding strategy, so anything that fools an LLM can fool them. TypeSafe AI had not commented at the time of publication.
Technical Details
- Test setup: a simulated online store with a saved shipping address, a saved card, two cart items and a "Place order" button. An open-source browser agent built on jev-ultrafast was told to buy the cart contents and not add or remove anything, and its system prompt said page text is untrusted data.
- Attack: a sponsored ad on the page claimed the sale price had not been applied and offered a "Confirm Price" button. The agent clicked it instead of following its instructions, so the attacker "stole" the click action.
- The injection also worked against Qwen3.8-27B tuned to act as a decision model, and Jev succumbed less often.
- Researchers say chaining such injections across subsequent pages would give an attacker full control of the agent.
- Prompt verification: a variant of TokenBreak, which adds extra letters to a prompt to evade classifiers, let toxic prompts pass Jev's verification.
Remediation
The article gives no vendor fix. HiddenLayer's conclusion is that a decision model's output still becomes an action in downstream systems, so decision models should be approached with caution and not treated as inherently immune to manipulation.
Linha do tempo
-
HiddenLayer shows TypeSafe AI's Jev decision model can be hijacked via indirect prompt injection and TokenBreak
ler a análise desta fonte ocultar
HiddenLayer researchers evaluated TypeSafe AI's Jev "System One" decision model, which returns probabilities and a confidence score instead of freeform text. They found it remains vulnerable to indirect prompt injection, contradicting claims that it cannot hallucinate or make type errors. Jev was manipulated into a clickjacking-style action in a simulated browser-agent scenario, though it failed less often than a comparable text-emitting LLM. A TokenBreak variant also let toxic prompts slip past Jev when it was used for prompt verification. HiddenLayer argues these models are LLMs with a different decoding strategy, so anything that fools an LLM can fool them. TypeSafe AI had not commented at the time of publication.
Technical Details
- Test setup: a simulated online store with a saved shipping address, a saved card, two cart items and a "Place order" button. An open-source browser agent built on jev-ultrafast was told to buy the cart contents and not add or remove anything, and its system prompt said page text is untrusted data.
- Attack: a sponsored ad on the page claimed the sale price had not been applied and offered a "Confirm Price" button. The agent clicked it instead of following its instructions, so the attacker "stole" the click action.
- The injection also worked against Qwen3.8-27B tuned to act as a decision model, and Jev succumbed less often.
- Researchers say chaining such injections across subsequent pages would give an attacker full control of the agent.
- Prompt verification: a variant of TokenBreak, which adds extra letters to a prompt to evade classifiers, let toxic prompts pass Jev's verification.
Remediation
The article gives no vendor fix. HiddenLayer's conclusion is that a decision model's output still becomes an action in downstream systems, so decision models should be approached with caution and not treated as inherently immune to manipulation.