---
title: HiddenLayer: 'decision' model Jev still falls for prompt injection; a fake ad got 91% of the checkout click | ctxsec
url: https://ctxsec.com/items/hiddenlayer-jev-prompt-injection
description: ""
status: "vendor research"
published: 2026-10-14
---

> 

[← AI](/ai) · [markdown](/items/hiddenlayer-jev-prompt-injection.md)

vendor research

2026-10-14

### HiddenLayer: 'decision' model Jev still falls for prompt injection; a fake ad got 91% of the checkout click

HiddenLayer tested Jev, TypeSafe AI's early-access model that returns typed choices and probabilities instead of text, to see if decision-style output resists manipulation. In a simulated store, a browser agent on jev-ultrafast was told to buy the cart and that page text is untrusted; a sponsored ad offering a "Confirm Price" button drew 91% of Jev's probability versus 9% for Place order. A Qwen-based look-alike HiddenLayer built for comparison went from 99.7% Place order to 79.9% for the ad. In a second test, an expanded TokenBreak spelling attack got many of 30 toxic prompts past Jev used as a toxicity filter. Caveats: HiddenLayer sells AI security products, and its posts do not state trial counts for the Jev checkout run. Takeaway: a typed decision is still model output; put a deterministic check between it and any action that moves money, data or access.

Sources: [HiddenLayer insight (Oct 14)](https://www.hiddenlayer.com/insight/jev-security-risks-ai-decision-models) · [HiddenLayer research write-up](https://www.hiddenlayer.com/research/system-one-model-security) · [The Register](https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be-tricked-with-prompt-injection/5303184)