---
title: "[AUTO] Typed Decisions Don't Stop Prompt Injection"
pubDatetime: 2026-10-15T17:47:00.000Z
description: "Jev's structured outputs provide some protection against prompt injection, but researchers found attackers can still shift decision probabilities to influence autonomous agent behavior."
tags: [prompt-injection, jev, ai-security, vulnerability, 2026, 2026-q4, 2026-10, AUTO]
---
TypeSafe AI markets Jev as safe because it returns typed decisions rather than text: no hallucinations, no type errors. [Researchers Tiantong Wu and Wei Yang Bryan Lim tested that assumption](https://arxiv.org/abs/2609.28613) on 510 attacks. Jev still fell.

The threat shifts, doesn't vanish. Jev won't pick an outright false action (typing prevents that), but attackers can shift confidence scores to swing which allowed action wins. When Jev sits in an agent's decision loop, that's a real problem. Adaptive attacks doubled success rates from 1.8% to 3.5%.

The core insight: Jev is still an LLM underneath. Different decoding strategy, same model. Architectural safety narrows attack surface, doesn't prevent it. The risk moved from hallucination to probability manipulation, which is exactly where autonomous agents are exposed.

---

*Sources: [Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions](https://arxiv.org/abs/2609.28613)  •  [Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use](https://arxiv.org/abs/2610.04985)*

*Coverage: [Jev and other decision models can still be tricked with prompt injection](https://www.theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be-tricked-with-prompt-injection/5303184)*

*Related on this blog: [Typed Decision Models: The Roster and the Benchmark Fine Print](/posts/decision-models-roster-benchmarks)  •  [[AUTO] Grok's Trust Boundary Problem](/posts/auto-grok-injection)  •  [[AUTO] Self-Propagating Prompts Infect AI Agents](/posts/auto-agent-prompt-infection)*