# Jev Cannot Invent a Tool. It Can Still Let the Wrong One Run. > TypeSafe launched Jev on 15 September as a System One decision model: state in, Choice, Score, or yes-or-no probability out. Security teams can put it on every tool call, retrieved passage, and agent trace. It cannot invent an option outside the schema. It can still pick the wrong option, including under injected text. Code owns the allowlist. Jev advises. Source: https://hackerlogs.com/blog/typesafe-jev-security-gate Published: 2026-09-22 ## Key takeaways - Jev is a gate, not a sandbox. It returns typed answers with probabilities in 70 to 500 milliseconds at $0.042 per million input tokens. Output is free because there is no generated string. - TypeSafe's zero-hallucination claim is schema matching. Almeida agreed on Hacker News that type safety is not factual correctness. A wrong yes is still a yes. - The security jobs are tool-call screening, injection checks on retrieved text, loop detection, and escalation when confidence is low. Ask one risk per question. - jev-1.13 does not treat state as hostile. Injected instructions, self-arguing tool arguments, and padded context can move the answer. Filter in code first. - A Choice always nominates a winner. Pair it with a yes-or-no on whether any action should run. Keep path allowlists, spend caps, and hard step limits in code. Hacker News spent today arguing OpenJev clones. US X News spent the weekend on TypeSafe's launch. Google still surfaces the speed claims. The operator question is narrower: can a 70-millisecond typed answer sit in front of a tool call without becoming the only lock. A cheap gate for every agent step. Info because this is a control you can add, not a CVE you can file. TypeSafe Jev as a security gate: typed answers on every tool call, a closed schema that still permits a wrong yes, and the operator work of keeping allowlists and spend caps in code. ## What TypeSafe actually shipped. [Diogo Almeida](https://typesafe.ai/blog/introducing-system-one-models-and-jev) launched Jev on 15 September. Access opened without a waitlist on 20 September. [TechCrunch](https://techcrunch.com/2026/09/18/a-new-kind-of-ai-model-from-a-chatgpt-inventor-is-thrilling-developers/) put the InstructGPT and RLHF history on the record. [Vercel](https://vercel.com/changelog/typesafe-ai-jev-now-available-on-ai-gateway/) put it on AI Gateway the next day. [Tom's Hardware](https://www.tomshardware.com/tech-industry/artificial-intelligence/typesafe-ais-jev-offers-an-alternative-to-llms-that-claims-to-be-193x-faster-and-445x-cheaper-system-one-type-model-is-bespoke-for-probabilistic-decision-making) is still carrying the 193x and 445x homepage numbers. The contract is small. You send state and a map of questions. Each question is a Choice over a closed set, a Score on an ordered rubric, or a yes-or-no probability TypeSafe calls a Noul. Jev evaluates the questions in parallel. It returns typed values and a distribution. It does not write a paragraph. TypeSafe prices input at $0.042 per million tokens and does not charge for output. The launch post calls this a frontier-intelligence function call, and it markets zero hallucinations. The footnote in TypeSafe's own nuance is the ticket: that number is schema matching, not empirical accuracy. A hallucinated tool name is impossible if the name was never in the list. A wrong listed name is still in bounds. > Almeida agreed on Hacker News that type safety is not factual correctness. jev-1.13's jaggedness page is blunter: state is data, and the model does not treat it as hostile. Injected instructions, misleading framing, and text that argues for its own class can move the answer. A closed schema stops invented verbs. It does not stop a yes. TypeSafe trains with a method it names Reinforcement Learning for Calibrated Decisions. As of this week there is no paper, no curves, and no public reproduction. Treat calibration as a claim you measure on your own labels before you set a threshold. ## Where it belongs in a security harness. The useful jobs are the ones a coding agent already does badly at speed. Screen the proposed tool call before the runtime runs it. [Learn Jev](https://learnjev.com/tutorials/agent-harness) and Vercel's eve helper do this as a cheap second opinion: destructive, outside scope, reversible, blast radius. Ask one risk per question so code can see which check failed. Escalate when confidence about scope is low, even if the picked label looks safe. Unsure is a first-class stop. Screen retrieved passages and file contents before a planner reads them. A yes-or-no per passage can drop injected instructions from a RAG stack. That is not a prompt-injection patch. It is a filter you can afford on every hop. Grade the trace. Looping, no progress, goal already met. Fast enough to run every step. Keep a hard step limit in code anyway. The model is watching a trace the agent wrote. Route the uncertain case to a person. High confidence, act. Medium, confirm. Low, stop. Set each band from the cost of a wrong yes, not as one global number. A read can run cooler than a refund or a shell. > A Choice always nominates a winner because the probabilities sum to one. If your list is only tools, Jev will pick a tool. Pair the Choice with a yes-or-no on whether any action should run. The absolute question is the one that is allowed to be low for every option. Pass tool name and arguments as named fields. Do not concatenate attacker-reachable text into the question. Filter the state in code first. jev-1.13 loses accuracy when the state is padded with unrelated detail, and it cannot count or do date math. Those belong in the runtime. ## What this is not. It is not a sandbox. [Heapjack](/blog/codex-heapjack-overpatch) showed a Codex deny that lived in the same heap as the agent. Jev sitting in the harness is still a judgment the attacker can try to steer. Put the gate in front of the call. Keep the process isolation in a layer the model cannot read. It is not [Plugin4Shell](/blog/plugin4shell-sha-pin-rce). A pin that does not verify the checkout is a different ticket. Jev cannot see a swapped tree unless you send it the bytes. It is also not a planner and not a writer. If you need an explanation, you wanted a chat model. If you need a path allowlist, you wanted code. ## What to do. If you run agents that call tools, fetch pages, or install skills: 1. Read TypeSafe as the scope. Typed answers. Parallel questions. Closed schema. Vendor speed and price. No public RLCD paper. Adversarial state is a documented edge. 2. Put Jev on the proposed tool call, not on the user's chat. Named fields. One risk per question. Escalate on low confidence, not only on a bad label. 3. Keep permissions, path allowlists, spend caps, and step limits in code. The gate does not grant. The runtime grants. 4. Build an injection set: arguments that declare themselves safe, files that claim to be instructions, passages that rewrite the question. Log the full probability distribution. When something gets through, that vector is the trail. 5. Pin `jev-1.13.0` or the version you measured. `jev-latest` moves. Thresholds tuned on one build can drift on the next. Re-run the set before you upgrade. The cheap part is real. You can afford a judgment on every step. The dangerous part is treating that judgment as the deny. Jev cannot invent a tool. Your code still has to be allowed to say no. ## Sources - [Introducing System One Models and Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) (2026-09-15) - [Jev 1.13 jaggedness](https://docs.typesafe.ai/model-jaggedness/jev-1.13) (2026-09-17) - [Building an agent harness with Jev](https://learnjev.com/tutorials/agent-harness) (2026-09-18) - [TypeSafe AI's Jev now available on AI Gateway](https://vercel.com/changelog/typesafe-ai-jev-now-available-on-ai-gateway) (2026-09-16) - [A new kind of AI model from a ChatGPT inventor is thrilling developers](https://techcrunch.com/2026/09/18/a-new-kind-of-ai-model-from-a-chatgpt-inventor-is-thrilling-developers/) (2026-09-18) - [TypeSafe AI's Jev offers an alternative to LLMs that claims to be 193x faster and 445x cheaper](https://www.tomshardware.com/tech-industry/artificial-intelligence/typesafe-ais-jev-offers-an-alternative-to-llms-that-claims-to-be-193x-faster-and-445x-cheaper-system-one-type-model-is-bespoke-for-probabilistic-decision-making) (2026-09-21)