Prompt injection can sway Jev decision models despite safety claims
Security researchers found that Jev, a decision model from TypeSafe AI, can be manipulated through indirect prompt injection, despite claims that it cannot hallucinate or make type errors. Their tests suggest decision models face risks similar to text-generating language models, so the findings temper claims of greater safety while leaving their potential cost and performance benefits intact.
In a simulated online shop, a browser agent was told to buy the two items in its cart and not change them, with a system rule to treat page text as untrusted. A sponsored ad claiming the sale price had not been applied led the agent to click a “Confirm Price” button instead of following its instructions; the attack also worked on Qwen3.8-27B, though less often on Jev. Researchers additionally used a tokenbreak-style attack to get toxic prompts past a Jev-based verifier, arguing that a model’s decisions can still trigger unsafe actions in connected systems.
- Jev can be misled by hidden instructions on a webpage.
- The same shopping attack also worked on a tuned Qwen model.
- A Jev prompt verifier was bypassed with a tokenbreak-style attack.
New here? Start with this
Jev is a decision model made by TypeSafe AI. Decision models are designed to choose actions, while language models are often used to generate text; both can be built into software agents that read webpages and use online services.
Prompt injection is when instructions hidden in content an AI system reads influence what it does. This matters because an agent may encounter adverts or other page text while carrying out a task, even when its rules say to treat that text as untrusted.
AI systems that make decisions can take actions through connected tools, so misleading inputs may have practical consequences. Claims about reliability matter to organisations weighing potential cost and performance benefits against the risks of using these systems.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Decision models such as Jev may offer cost and performance advantages, and the reported tests found the shop attack worked less often on Jev than on the comparison model. Supporters could argue these results point to manageable weaknesses that can be reduced through careful system design, testing and limits on what connected agents may do.
The case against
The tests suggest that decision models remain vulnerable to indirect prompt injection and can be induced to take actions contrary to their instructions, even when page text is designated untrusted. Critics could argue that claims of stronger safety are premature when a verifier can also be bypassed, because errors in connected systems may have consequences beyond incorrect text.
Read the full article at the source →
Originally published by The Register as “Jev and other decision models can still be tricked with prompt injection”.