{"id":10018,"date":"2026-10-16T00:28:42","date_gmt":"2026-10-16T00:28:42","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10018"},"modified":"2026-10-16T00:28:42","modified_gmt":"2026-10-16T00:28:42","slug":"typesafes-jev-even-more-susceptible-to-attack-than-llms-says-security-vendor","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10018","title":{"rendered":"TypeSafe\u2019s Jev \u2018even more susceptible to attack\u2019 than LLMs, says security vendor"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Although the Jev model rolled out last month<\/a> by TypeSafe claims to have significant advantages over traditional LLMs, a security report published Wednesday argued that its streamlined approach makes it more vulnerable to some kinds of attack, compared to traditional LLMs.\u00a0\u00a0<\/p>\n

\u201cIn some cases, [Jev] is even more vulnerable to attacks, with both adversarial text attacks and prompt injection being able to disrupt the model\u2019s outputs, resulting in incorrect and potentially devastating actions,\u201d said the blog post from researchers at HiddenLayer<\/a>.\u00a0<\/p>\n

TypeSafe did not respond to multiple requests for comment.\u00a0<\/p>\n

LLM, or something else?<\/h2>\n

There seems to be debate about whether Jev is technically a large language model (LLM), with TypeSafe suggesting it is not, but HiddenLayer saying that it appears to be one. TypeSafe has even coined a name for the category: System One<\/a>, which TypeSafe described as \u201ca new class of frontier models built to make fast, structured decisions that software can use directly.\u201d Jev is the first\u2014and thus far, only\u2014named product categorized as System One.<\/p>\n

Jev is a streamlined model designed to function machine-to-machine. Its approach allows it to perform tasks faster and to use fewer tokens. But Kasimir Schulz<\/a>, the director of security research at HiddenLayer, the blog\u2019s co-author, said that the accelerated approach robs Jev of some of the checks and balances that exist in traditional LLMs. This means that Jev can fall for some attacker tricks that current LLMs typically detect and refuse, he said in an interview.\u00a0<\/p>\n

Despite this, \u201cJev is great. You should use it. It has a lot faster response time,\u201d he said, with the caveat \u201cit doesn\u2019t have all of the protections\u201d seen in traditional LLMs, so some attacks on it succeed that should have failed.\u00a0<\/p>\n

\u201cTokenBreak<\/a>, for example, normally does not work with larger LLMs, but Jev is vulnerable to it out of the box,\u201d Schulz said.\u00a0<\/p>\n

Although simply inserting characters in front of important words, as in the original TokenBreak attack, did not yield much, HiddenLayer\u2019s blog noted, \u201cwe did notice that increasing the number of perturbations and improving their targeting led to much higher attack success rates.\u201d<\/p>\n

But although traditional LLMs are typically able to see through such attacks, it pointed out, \u201cSystem One models appear to be vulnerable. As a result, this class of decoder should be treated with caution, given that they are susceptible to both autoregressive LLM attacks and text classifier attacks, providing potential adversaries with greater optionality.\u201d<\/p>\n

The post cited some examples:\u00a0<\/p>\n

\u201cOn a simulated checkout page, an attacker-controlled advertisement caused the browser agent to click away from the user\u2019s purchase [and respond to the ad] despite instructions to treat page text as untrusted,\u201d it said. \u201cIn a separate classification test, targeted TokenBreak-style changes lowered toxicity scores for prompts both models had initially flagged.\u201d<\/p>\n

The post argued that multiple risks are therefore associated with Jev.\u00a0<\/p>\n

\u201cA browser agent may immediately click a selected element. A moderation system may allow an input whose toxicity score falls below a threshold. A routing system may send a request to a different tool or workflow. Each of these turns a model judgment into an operational decision, and therefore, risk,\u201d the post said. \u201cWhen evaluating System One models, test those decisions in the application where they will be used. Include untrusted webpages, misleading task-related text, and modified inputs that preserve their meaning while changing their form. Monitor the selected actions and scores and put independent checks around outcomes that matter. Keep in mind that, under the hood, these are still language models at heart.\u201d<\/p>\n

Analysts agreed with both the report\u2019s methodology and its technical conclusions, while also pointing out that a security vendor concluding that a new approach is not secure is somewhat self-serving.<\/p>\n

Philip Harris<\/a>, an IDC research director, observed that the methodology described in the blog post \u201cis sound, and consistent with established AI red-teaming practice: building a controlled test environment and probing for adversarial manipulation and injection is exactly the right approach.\u201d<\/p>\n

But Gartner VP Analyst Nader Henein<\/a> added that Jev, which was introduced on Sept. 15, is so new that he thinks some of the flaw reports were premature.<\/p>\n

\u201cJev will go through the same maturity process as do all other models, including susceptibility to seemingly rudimentary manipulation attempts,\u201d Henein said. \u201cThis model was only released last month, so being surprised that it has issues is similar to being surprised when your baby drools.\u201d<\/p>\n

However, Frank Dickson<\/a>, principal analyst at Dickson Research, noted that the same attributes that make Jev so attractive also expose it to riskier behavior.<\/p>\n

\u201cJev can only choose from options the developer puts on the menu,\u201d he said. \u201cIt limits attack paths. However, if \u2018click any element on the page\u2019 is on the menu, the attacker\u2019s ad is on the menu. That is an architecture decision, and the buyer makes it.\u201d<\/p>\n

He pointed out, \u201cJev makes AI decisions faster and cheaper, which also makes the wrong decisions faster and cheaper. Speed is a feature. It is not a security control.\u201d<\/p>\n

Independent technology consultant Steven Eric Fisher<\/a> agreed. <\/p>\n

\u201cConstraining the format of a decision does not necessarily constrain the correctness, trustworthiness, or consequences of that decision,\u201d he said, noting, \u201cthe simulated checkout scenario [in the post] illustrates how an agent can be redirected from an authorized task by information introduced through a less-trusted component of its operating environment. The fact that the agent was explicitly instructed not to trust page content, yet still responded to the malicious advertisement, is particularly relevant.\u201d<\/p>\n

This article originally appeared on InfoWorld<\/a>.<\/em><\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Although the Jev model rolled out last month by TypeSafe claims to have significant advantages over traditional LLMs, a security report published Wednesday argued that its streamlined approach makes it more vulnerable to some kinds of attack, compared to traditional LLMs.\u00a0\u00a0 \u201cIn some cases, [Jev] is even more vulnerable to attacks, with both adversarial text […]<\/p>\n","protected":false},"author":0,"featured_media":10019,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10018","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10018"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10018"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10018\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10019"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10018"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10018"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}