Our summary
A model can make a quick choice and still choose the wrong thing. HiddenLayer tested Jev in a simulated online checkout. Although the agent was told not to follow instructions on the page, a misleading advertisement persuaded it to choose another button instead of placing the requested order.
In one example, Jev assigned the ad’s Confirm Price button 91 percent probability and Place order 9 percent. That is one set of choice scores, not a repeated attack success rate. A second test altered spellings in toxic messages that the models had previously flagged, lowering their toxicity scores.
The researchers tested Jev through its outside service and used a converted Qwen model for controlled comparisons. That does not reveal Jev’s private design. These limited vendor tests suggest checking actual actions and meaning-preserving text changes, with independent restrictions around important outcomes rather than trusting the shape of the answer.
Key takeaways
- Instructions saying page text is untrusted did not stop the demonstrated checkout attack.
- A safety score can change when spelling changes even though the harmful meaning remains.
- Check what an agent actually does, not just whether its answer fits the required format.