Full Report
Never making type errors does not mean never making errors
Analysis Summary
# Vulnerability: Indirect Prompt Injection in Jev System One Decision Models
## CVE Details
- **CVE ID**: Not yet assigned (N/A)
- **CVSS Score**: Estimated 7.5 (High) - based on unauthorized action execution
- **CWE**: CWE-1039: Automated Recognition Mechanism with Inadequate Adversarial Robustness (related to OWASP LLM01: Prompt Injection)
## Affected Systems
- **Products**: TypeSafe AI Jev (System One models); traditional LLMs tuned for decision output (e.g., Qwen3.8-27B).
- **Versions**: `jev-ultrafast` and potentially other versions of the Jev decision engine.
- **Configurations**: Decision models used as browser agents or prompt verifiers/classifiers where external, untrusted data (e.g., web page text) is processed.
## Vulnerability Description
Despite TypeSafe AI’s claims that Jev avoids "type errors" and hallucinations by outputting probabilities rather than freeform text, the model remains an LLM at its core. The vulnerability arises from the model's underlying decoding strategy which, while constrained to specific outputs, still processes untrusted input strings as instructions.
Researchers discovered that "System One" models are susceptible to **Indirect Prompt Injection**. By embedding malicious "instructions" within a web page (e.g., a fake "Confirm Price" button), an attacker can hijack the model’s decision-making logic. The model prioritizes the injected task over its original system prompt instructions, leading it to perform unintended actions (Clickjacking). Additionally, the model is vulnerable to **Tokenbreak attacks**, where adding extra letters or specific token sequences allows toxic prompts to bypass the model's verification filters.
## Exploitation
- **Status**: PoC available (demonstrated by HiddenLayer researchers).
- **Complexity**: Low to Medium (requires crafting deceptive UI elements or text).
- **Attack Vector**: Network (Indirect via malicious web content or sponsored ads).
## Impact
- **Confidentiality**: Medium (Potential to redirect agents to credential-harvesting sites).
- **Integrity**: High (Attacker can gain full control over agent actions, such as altering purchases or clicking malicious links).
- **Availability**: Low (Interrupts intended workflow).
## Remediation
### Patches
- No specific patches have been released by TypeSafe AI as of the reporting date.
### Workarounds
- **Human-in-the-loop**: Require manual confirmation for critical actions (e.g., "Place Order").
- **Strict Input Sanitization**: Implement rigorous filtering of web content before it is processed by the decision model.
- **Task Isolation**: Limit the scope of actions a decision-model agent can take on a single page session.
## Detection
- **Indicators of Compromise**: Unexpected deviations in agent logs where a model clicks on elements not present in the original task workflow (e.g., clicking "Sponsored Ads" or "Confirm Price" prompts).
- **Detection Methods**: Monitoring for "Tokenbreak" patterns (unusual character repetitions or spacing) in input prompts intended for verification.
## References
- HiddenLayer Research: hxxps[://]www[.]hiddenlayer[.]com/research/system-one-model-security
- HiddenLayer Insight: hxxps[://]www[.]hiddenlayer[.]com/insight/jev-security-risks-ai-decision-models
- OWASP LLM01 Prompt Injection: hxxps[://]genai[.]owasp[.]org/llmrisk/llm01-prompt-injection/
- Tokenbreak Attack: hxxps[://]www[.]hiddenlayer[.]com/research/the-tokenbreak-attack