Is TypeSafe Jev patched against the prompt injection HiddenLayer found?

HiddenLayer's post records no fix and no response from TypeSafe. The research describes a weakness in how System One models weigh untrusted page text, not a software bug with a version number, so there is nothing for users to install. Teams building on Jev should add their own checks around any decision that matters rather than wait for a patch.

Does using a System One model instead of an LLM remove prompt injection risk?

No. Kenneth Yeung and Kasimir Schulz state that using a System One model does not automatically negate the risk of prompt injection, and they advise treating the whole decoder class with caution. Jev answers typed questions with probabilities rather than generating text, but HiddenLayer found the model still follows instructions planted in the page it reads.

How does the TokenBreak result on Jev compare to HiddenLayer's 2025 TokenBreak work?

TokenBreak, published by HiddenLayer in June 2025, bypassed text classifiers by adding characters so that BPE or WordPiece tokenizers split words differently while the meaning survived. Applied to Jev and to HiddenLayer's own System One model, single character insertions achieved little, but more numerous and better targeted perturbations raised attack success across many prompts in the test corpus.

MEDResearch Attack

Jev: a planted ad derails TypeSafe's System One model

System One models return structured decisions, not text, and HiddenLayer shows they inherit prompt injection and classifier evasion.

October 14, 2026 · HiddenLayer · Research by Kenneth Yeung, Kasimir Schulz

TypeSafe Jev

Jevil in the Details, HiddenLayer research title card

MEDResearch

TypeSafe's Jev and other System One models follow instructions planted in untrusted web pages, HiddenLayer reports, and evade their own toxicity scoring under TokenBreak-style edits.

01What happened

HiddenLayer researchers Kenneth Yeung and Kasimir Schulz published tests of TypeSafe's Jev on 14 October 2026. Jev is the first public System One model, a class that answers typed questions with calibrated probabilities instead of generating text. The team ran two experiments against it: a browser agent task and a toxicity scoring task.

02How it works

The jev-ultrafast harness turns a web page into a numbered list of interactive elements and asks the model which one to pick. An attacker-controlled ad on the page tells the agent to finish another task before checkout, and the model selects the ad even though its system prompt marks page text as untrusted. For the second experiment the team applied TokenBreak, their 2025 technique that adds characters to words so a tokenizer splits them differently while the meaning survives.

03Who is affected

Jev reached through TypeSafe's API and OpenAI's GPT-6 Luna through the Decisions API both made the attacker's choice, GPT-6 Luna less consistently. HiddenLayer saw the same behaviour in its own System One model built on Qwen3.8-27b, and in that model's conventional autoregressive variant. TypeSafe announced Jev in early access on 15 September 2026.

04What to do

HiddenLayer recommends testing these models inside the application that will use them, including against untrusted web pages and against inputs reworded to keep their meaning while changing their form. Monitor the decisions and scores a System One model returns, and put independent checks around outcomes that matter.

Questions people ask

Is TypeSafe Jev patched against the prompt injection HiddenLayer found?: HiddenLayer's post records no fix and no response from TypeSafe. The research describes a weakness in how System One models weigh untrusted page text, not a software bug with a version number, so there is nothing for users to install. Teams building on Jev should add their own checks around any decision that matters rather than wait for a patch.
Does using a System One model instead of an LLM remove prompt injection risk?: No. Kenneth Yeung and Kasimir Schulz state that using a System One model does not automatically negate the risk of prompt injection, and they advise treating the whole decoder class with caution. Jev answers typed questions with probabilities rather than generating text, but HiddenLayer found the model still follows instructions planted in the page it reads.
How does the TokenBreak result on Jev compare to HiddenLayer's 2025 TokenBreak work?: TokenBreak, published by HiddenLayer in June 2025, bypassed text classifiers by adding characters so that BPE or WordPiece tokenizers split words differently while the meaning survived. Applied to Jev and to HiddenLayer's own System One model, single character insertions achieved little, but more numerous and better targeted perturbations raised attack success across many prompts in the test corpus.

Sources 3 links, all fetched

1hiddenlayer.comHiddenLayer Research
2typesafe.aiTypeSafe Jev Launch
3hiddenlayer.comTokenBreak Attack