Hijacked by injectionPI-0098
In a researcher test, a fake ad hijacked a Jev-based shopping agent into clicking away from checkout
A sponsored ad on a simulated checkout page claimed the sale price had not been applied, and the agent chose its Confirm Price button instead of placing the order. The agent had been told to buy only what was in the cart, and to treat page text as data, never instructions. TypeSafe AI's Jev gave the ad button 91 percent against 9 for placing the order. OpenAI's gpt-6-luna and HiddenLayer's own converted Qwen model were also misled. HiddenLayer says chaining such ads across pages would effectively give an attacker full control of this agent.
Harm: No harm reportedControl level 2, Instruction violation
Not counted · can set the control floorEffect on the index
Sources
How we know
3 sources · single source. Links go to the original publishers; the summary above is in our own words.
- researchJevil in the details: Security implications of TypeSafe Jev and other System One modelsHiddenLayer · Oct. 14, 2026hiddenlayer.com/research/system-one-model-security
- newsJev and other decision models can still be tricked with prompt injectionThe Register · Oct. 15, 2026theregister.com/ai-and-ml/2026/10/15/jev-and-other-decision-models-can-still-be…
- blogJev Talking: Security Concerns for Models That Return Decisions Instead of TextHiddenLayer · Oct. 14, 2026hiddenlayer.com/insight/jev-security-risks-ai-decision-models
Why this rating
No harm reported; control failure level 2
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm reportedThe test used a simulated store. No effect outside it is described.
Not a finding that no harm occurred.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Instruction violationFollowed instructions planted in a page ad instead of its user's task and its own rule to treat page text as untrusted. It acted only within the clicks it was allowed to make.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
HiddenLayer's own write-up describes the test, and The Register's report rests on it. The agent followed instructions planted in an ad instead of its user's task and a rule telling it to treat page text as data. That is breaking its instructions within the access it had, and it reached nothing beyond a simulated store. Being hijacked this way is not a loss of control: the researchers ran the test throughout and the agent resisted nothing. Nothing outside the test was touched, so no harm is recorded.
Effect on the index
Not yet in a weekly reading
Not counted: no harm reported.
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 16, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “In a researcher test, a fake ad hijacked a Jev-based shopping agent into clicking away from checkout.” Record PI-0098. Reported Oct. 14, 2026; updated Oct. 16, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0098