Security firm HiddenLayer tested TypeSafe AI's Jev decision model, which the vendor claims never hallucinates or makes type errors, and found it remains vulnerable to indirect prompt injection. Researchers built a simulated online store and showed a browser agent built on Jev could be tricked into clicking a malicious 'Confirm Price' button instead of following its instructions, with chained attacks potentially giving attackers full control. A similar tokenbreak-style attack also bypassed Jev's prompt verification use case. The finding applies broadly: decision models are still LLMs under the hood using a different decoding strategy, so they inherit the same manipulation risks as text-generating models.
Table of contents
READ MOREQuestions this post answers
Can decision models like Jev be tricked with prompt injection even though they never make type errors?
Yes, decision models remain vulnerable to prompt injection despite not hallucinating in the traditional sense. HiddenLayer researchers showed a browser agent built on TypeSafe AI's Jev model could be manipulated into clicking a fake 'Confirm Price' button on a malicious webpage instead of following its original checkout instructions, because the model is still an LLM using a different decoding strategy under the hood. Teams evaluating decision-model agents for safety can track emerging AI security research like this on daily.dev.
What is the tokenbreak attack and how does it affect AI prompt verification?
Tokenbreak is an attack technique that adds extra letters to a prompt to evade classifiers, originally documented by HiddenLayer. Researchers applied a variant of it against Jev when used for prompt verification, one of its suggested applications, and were able to sneak toxic prompts past the verification process, showing the technique works even against decision-style models. Developers building prompt-verification pipelines can follow security research like this via daily.dev to anticipate evasion techniques.
Share this post