- HiddenLayer reports that TypeSafe's fast Jev decision model, and a similar model it built, followed an attacker's ad and scored altered toxic prompts lower.
- When a model's output is a click or a score, a wrong answer becomes an action immediately, and often no one reads an explanation first.
- Test these models inside the real application, log their scores and actions, and add independent checks around outcomes that matter.
A fast AI model that returns a choice instead of a sentence leaves less for anyone to read before the action happens. That is the idea behind a new class of models, and it is also the risk. Speed removes the wait. It does not remove the weakness.
Security firm HiddenLayer tested TypeSafe's Jev, a model built for quick decisions. In its tests, an advertisement on a simulated checkout page pulled a browser agent away from the user's purchase. That happened even though the agent was told to treat page text as untrusted.
A choice, not a sentence
Modern AI agents make many small decisions. Which tool to use. Whether a request is relevant. Whether a person needs to step in. HiddenLayer describes sending each of these through a frontier language model as slow and often expensive.
TypeSafe argues that text generation is the wrong engine for this work. It names its category System One. The pitch is a model that answers with a selection or a number, so code can act on it straight away. TypeSafe's own figures put Jev as much as 193 times quicker and 444 times cheaper than standard setups. Those are the company's claims, not HiddenLayer's findings.
How a decision model works
A conventional model writes its answer one piece of text, called a token, at a time. In HiddenLayer's account, the length of a tool call varies widely. Some need only a few tokens. Others need hundreds. Its example is a poker agent raising by 100 chips. Writing that one call takes about 9 tokens, so the model runs about 9 times.
A System One model skips that loop. The application hands it the current state and a set of questions. HiddenLayer describes three kinds. A Choice picks from fixed options. A Score picks a value on a scale the developer sets. A third returns the probability that a statement is true. The answer is assembled from the model's decision scores, so speed depends less on how long the answer is.
TypeSafe has not disclosed Jev's exact architecture. HiddenLayer says it rebuilt a similar workflow by removing the normal decoding step from an existing model. It used a converted version of Qwen3.8-27b as its stand-in. HiddenLayer's point is that these are still language models underneath, with a different way of producing output.
What HiddenLayer tested
The first test used a simulated checkout page and a harness called jev-ultrafast. It turns a web page into a numbered list of clickable elements and asks the model which to click. With a normal page, the agent chose to place the order.
HiddenLayer then changed the ad to claim another task must be finished before checkout. The agent clicked the ad. HiddenLayer says it consistently took over the click with no unusual prompting tricks.
The result carried across systems. Jev, accessed through TypeSafe's API, behaved in a very similar way. OpenAI's Decisions API with gpt-6-luna gave the same wrong decisions, with less consistency. The conventional version of HiddenLayer's own model was also derailed. So the checkout attack is not unique to the new design.
The second test was about content filtering. HiddenLayer wrote 30 toxic prompts and asked each model for an is_toxic score. At baseline, all 30 were flagged. Then it applied TokenBreak-style changes, which alter how words are split into tokens so a classifier misses them. Simple versions did little. More changes, aimed at the right words, worked far better. Both Jev and the in-house model were vulnerable across many prompts.
Where the difference lies
Kasimir Schulz, HiddenLayer's director of security research, told InfoWorld that the fast approach drops some checks found in traditional models. He said TokenBreak "normally does not work with larger LLMs, but Jev is vulnerable to it out of the box." He also said "Jev is great. You should use it."
The lesson here is that a model's output format is part of its security design. When the output is a click, a score or a routing choice, often no one reads an explanation first. A mistaken answer becomes an action.
What the tests do not show
HiddenLayer calls its results limited. It tested Jev, its own model and the stock version of that model. It says other models gave largely the same results.
HiddenLayer is a security vendor, and the in-house model is its own reconstruction. InfoWorld reports that analysts agreed with the methodology and technical conclusions. TypeSafe did not respond to InfoWorld's requests for comment. There is also debate over whether Jev counts as a large language model. TypeSafe suggests it does not. HiddenLayer says it appears to be one.
Questions to put to your team
HiddenLayer recommends trying any such model inside the real application. Feed it hostile web pages, misleading task text, and reworded inputs that mean the same thing but look different. Log what the model chose and the scores it gave. Then add separate safeguards around results that carry real consequences.
For leaders, that turns into a short list. Which decisions in our agents move money, data or customers? Does a rule outside the model confirm those decisions? Do we log scores as well as actions? Has anyone attacked our filter with altered inputs, or only clean inputs?
A faster decision is a good trade only if someone has decided which mistakes the business can absorb. Speed saves seconds. An unchecked wrong click can cost far more.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: HiddenLayer.
