A red-team of Jev 1.13 got it to approve harmful tool calls 70.1% of the time under direct misuse and 43.5% under indirect injection. The fix has a nice shape: Jev re-judges its own tool calls before they run, and both attack rates roughly halve.
Self-gating drops direct misuse to 36.1% and injection to 21.6%, costing a little benign success: 60.9% to 55.8%. What still gets through is the interesting part. No single call looks wrong; the session is wrong. Injections split across environment, skills, and tool descriptions, and in coding and OS domains abuse wears use's clothes. One caveat from checking the platform itself: the public DTAP repo has no Jev backend at all. The evaluation ran on an integration the team hasn't shipped.
