The Jevil in the details: security implications of TypeSafe Jev and other System One models

HiddenLayer's tests show that TypeSafe's System One model Jev and other similar models can still be led astray by indirect prompt injection and text perturbation attacks; changing the decoding method did not eliminate common risks. On a simulated checkout page, despite the system prompt stating that page text is untrusted, attacker-controlled ads still caused the browser agent to click ads and leave the purchase flow; the Jev API, a self-developed model based on Qwen3.8-27b, and gpt-6-luna from the OpenAI Decisions API all gave incorrect decisions, and a traditional autoregressive model using the jev-ultrafast harness was also led astray. In a classification test with 30 harmful prompts, both model baselines gave high toxicity scores, but after increasing the number of perturbations and improving the target, TokenBreak-style perturbations could bypass them.