A DTap chart puts a Jev 1.13 tool selector at 70.1% attack success, and a second Jev call at 36.1%

Zhaorun Chen posted on September 27 that a Jev 1.13 agent on the DecodingTrust-Agent platform followed attacks often. The chart calls the setup a tool selector. Direct misuse attack success is 70.1%. Indirect prompt injection is 43.5%. Benign tasks succeed 60.9% of the time. The chart does not say how many tasks sit under those bars.

The same image prints other agents on those axes. On direct misuse, Muse Spark 1.3 is 10.0%, Opus-4.7 is 18.2%, Sonnet-4.5 is 26.9%, GPT-OSS-120B is 28.0%, GPT-5.5 is 28.9%, Gemini-3-Pro is 47.9%, GPT-5.4 is 51.0%, and DeepSeek-V4-Pro is 59.6%. On indirect injection, Gemini-3-Pro is the highest bar at 55.7%, and Muse Spark 1.3 is 7.0%. On benign tasks, Opus-4.7 is 90.1% and GPT-OSS-120B is 36.2%. Per API call, the Jev selector is the short bar, 0.32 seconds. End-to-end task time on that row is 12.7 seconds.

The thread’s proposal is to call Jev again after the tool and its arguments are filled, and to block the call when that second read says the trajectory is harmful. The chart marks that row as self-gated. Direct misuse falls from 70.1% to 36.1%. Indirect injection falls from 43.5% to 21.6%. Benign success falls from 60.9% to 55.8%. Per-call time stays 0.32 seconds. Task time rises from 12.7 seconds to 19.1 seconds. Chen writes that the second check helps when the harm is explicit in the tool call, and that it still misses harm that only shows up across the trajectory, including consent and unauthorized access. He also writes that injections spread across the environment, the skills, and the tool descriptions still get through, especially in coding and operating-system tasks.

TypeSafe quoted the chart on September 29 and wrote that Jev is built so you can add more of it. The public leaderboard at decodingtrust-agent.com listed no agents when we opened it on September 29, so these bars are the post’s image, not a row we read off that board. The platform paper, arXiv:2605.04808, is from May. Its abstract describes the simulator and does not contain this Jev table. A reply under the thread links caiovicentino/jev-risk-check-provider. We did not rerun the chart.

On September 30, 2026 we opened that repository. It is public, on main, with 87 commits. The license file is MIT, copyright 2026 Caio Vicentino. The README calls the project x402check, a check before a wallet or an agent pays. The live host is x402check.xyz. Prepaid credits are $0.001 a check. A per-call x402 payment is $0.0035 on Base, and $0.005 when the check includes a transaction simulation.

The typed model in that README is TypeSafe Jev, reading the content an agent acted on for injected instructions. A sample evidence field names the model jev-wallet-risk/v6. The DecodingTrust bars are absent from that README.