Thomas Claburn’s report in The Register follows HiddenLayer’s tests of decision-model security. The useful distinction: preventing malformed answers does not prevent an attacker from steering the model toward the wrong allowed answer.

I read the full report and HiddenLayer’s linked research and companion explanation. The attacks and probabilities are HiddenLayer-reported, not independently reproduced here. This is a source review, not a security audit.

A checkout ad becomes an instruction

The test agent is told to buy the existing cart with saved details, and explicitly told that page text is untrusted data. A sponsored ad then claims a missing discount must be confirmed before checkout.

  • The agent can still select an allowed click while abandoning the user’s goal.
  • HiddenLayer’s companion account reports Jev assigning 91% to the ad’s “Confirm Price” button and 9% to “Place order.”
  • Those are reported probabilities for an example—not an attack-success rate or calibrated confidence in safety.
  • The researchers also show the failure with their Qwen-based decision model and its conventional text-generating version.

The attack creates a plausible prerequisite: to do the legitimate thing, first do this other thing. An instruction in the system prompt is not a substitute for an enforced action boundary.

A safety score can be manipulated too

HiddenLayer reports that Jev and its local comparison model initially flag all 30 toxic prompts in a small test set. Targeted spelling perturbations then let many edited prompts evade the classifiers.

  • The technique adapts TokenBreak: alter important words while preserving meaning for a human reader.
  • A clean baseline score does not establish resistance to adversarial variants.
  • The writeup does not publish a complete bypass count, fixed decision threshold, or repeated-trial rate; do not invent one.

Keep authorization outside the model

  • Constrain destinations and sensitive actions in ordinary application code.
  • Require independent confirmation for consequential state changes.
  • Test misleading task-related content and meaning-preserving edits in the actual workflow.
  • Log selected actions and verify outcomes, not just response types and confidence.

Typed output is not a correct decision, and a high probability is not permission to act.

HiddenLayer sells AI security products, and these are limited demonstrations rather than a representative benchmark. Its local Qwen model enables a same-model decoder comparison; it does not disclose or prove Jev’s private architecture. The Register reports that TypeSafe had not responded by publication.