Our summary
An agent using Jev can select an action without generating text. There may be no written reply or reasoning trace for defenders to inspect, Pillar Security argues. Its article considers where security checks should sit when the model's entire output is a decision.
Malicious instructions hidden in the information Jev reads can steer its answer, as TypeSafe's documentation warns. Pillar says the application must enforce its own limits before running other programs. The model's estimate of how likely an answer looks does not authorize an action.
An allowed answer can still be wrong. Pillar cites TypeSafe's examples of contradictory answers to opposite questions and recommends checking allowed actions, testing hostile input and involving people in consequential choices. The company's own security products follow that approach.
Key takeaways
- Try hostile documents and retrieved pages to see whether they alter the chosen action.
- Check permissions in the application before running an action the model selects.
- Neither a likely answer nor a correctly formatted one grants permission to act.