Agents Without LLMs: What Jev and System One Models Mean for AI Safety

Pillar Security analyzes TypeSafe's System One model Jev, arguing that this type of model, which does not generate text and only returns typed decisions with calibrated probabilities, removes the leverage points for three detection surfaces: prompt scanning, output filtering, and chain-of-thought monitoring. Jev was released on September 15, 2026, trained with RLCD, rewarding calibration rather than human preference, answering in parallel in a single forward pass, with a text input limit of 32k tokens. The authors say the attack surface shifts from the instruction channel to the data channel, equivalent to indirect prompt injection without prompts, and TypeSafe documentation also states that jev-1.13 does not treat state as adversarial by default. In a security operations alert triage evaluation, Jev's agreement rate with frontier references is 61.7%, at 0.3 seconds and $0.0001 per case, while Opus 5 achieves 66.2%, 15.1 seconds, and $0.0574. The article recommends moving defenses to the tool-call boundary and notes that its guardrails cookbook only covers jailbreaks and harmful content in chat text, not indirect injection or tool calls.