The AI That Doesn’t Talk: Jev, OpenAI and AWS Race to Sell Decisions, but the Real Contest Is Elsewhere How far can you trust cheap, fast decisions to act on their own?

01. Probabilities instead of prose: what makes decision models different

A typical generative language model builds its answer token by token. You can make it return just a short label or JSON with no explanation, but the output still goes through generation.^[6] Jev gives up free-form writing and focuses on computing, all at once, a probability or score for each option in a question the developer defined.^[1] The difference isn’t that it says less. It is that it was designed from the start to handle software’s small judgments quickly.

TypeSafe calls these “System One” models, after the fast, intuitive System 1 thinking Daniel Kahneman described. There are three question types: Choice picks one option, Score measures a degree, and Noul returns the probability that the answer is yes, as a number between 0 and 1.^[1] Choice and Score come with a separate confidence value; Noul returns only the probability of yes. So the two shouldn’t be read the same way. In particular, a Noul value near 0 doesn’t mean the model is unsure. It means the answer is very likely no.^[7] We covered usage in our Jev practical guide, so here let’s just watch how a generative model and a decision model handle the same question.

The company’s own numbers are bigger. TypeSafe charges $0.042 per million input tokens, nothing for output, and says end-to-end response time including the network is 70 to 500 ms. The homepage line “193.6x faster, 444.6x cheaper” comes from its own workflow evaluations, and the company itself describes these as toward the larger end of the improvements you can expect in real work.^[1][10]

“0% hallucination” also stands out. TypeSafe says it means answers always fit the defined schema, and that the 0% is guaranteed by design rather than measured.^[1] In other words, it is about the shape of the answer. That is not the same as the decision never being wrong, a difference that matters a lot in section 05.

02. The 16-day log

In the 16 days after Jev’s release, big companies and open-model developers piled into the same problem. They shared a goal but differed in approach and in how they ship. The dates below show the order of announcements; they don’t mean each team copied Jev in 16 days.

1. 9/15
   Jev launches with a $40M seedTypeSafe AI finished developing in private and released Jev in early access. Founder Diogo Almeida worked on the research behind ChatGPT at OpenAI. The company raised a $40 million seed round led by DCVC, at a reported $200 million valuation.^[1][3][4]
2. 9/18
   Open model Laya appearsIndia’s Convai Innovations posted Laya, a decision model of about 421 million parameters, on Hugging Face under Apache 2.0.^[11][12]
3. 9/23📋
   Independent accuracy test resultsGermany’s AI Hub Landau published results from a September 22 test comparing Jev 1.13 and Claude models on the same tasks (section 03).^[9]
4. 9/23📄
   A “decision hijacking” paperResearchers at Singapore’s Nanyang Technological University published prompt-injection experiments on Jev.^[13]
5. 9/24
   Check Point’s attack test · $10B talks reportedSecurity firm Check Point published experiments that changed Jev’s decision with fake evidence (section 05). The same day, The Information reported investment talks valuing TypeSafe at more than $10 billion. The article is paywalled and the round is not confirmed.^[14][5]
6. 9/25📄
   JevAdvBenchA paper describing itself as the first adversarial benchmark for models like Jev came out (section 06).^[15]
7. 9/28✍️
   An AWS engineer’s personal projectAWS’s Marc Brooker posted notes on his personal blog about building his own decision model. Three days later it became AWS’s open model.^[16][17]
8. 9/29
   OpenAI Decisions APIAt DevDay, OpenAI announced the Decisions API, built on GPT-6 Luna, in limited preview.^[18] On October 6 it opened to all developers as a public beta.^[21]
9. 10/1
   AWS Strands Decider 2BAWS Strands Labs open-sourced a 2-billion-parameter decision model, including weights, training data and scripts.^[8]

TypeSafe didn’t sit still either. A notice dated September 27 on its homepage says anyone can now sign up, no waitlist.^[10] So how good is Jev, the one that came first?

03. The independent test: Jev was faster, accuracy depended on the task

Germany’s AI Hub Landau compared Jev 1.13 with four Anthropic Claude models on 1,261 everyday business decisions, such as sorting emails, judging urgency and approving AI agent actions.^[9] Tap the tabs to see each task.

Jev matched Claude Haiku 4.5’s accuracy on some language classification tasks, but results varied by task. The widest gap was on numbers and dates: on the main question, the Claude models got 93 to 100% right while Jev got 79%. Also note that bundling 10 different items into one request dropped accuracy from 82% to 69%. That is several separate items crammed into one call; asking several questions about one input is exactly what TypeSafe recommends (section 07). None of this should be generalized into a ranking for every task and setup.^[9] The Claude models tested were current as of September 22; Anthropic released Claude Sonnet 5.5 on September 28.

TypeSafe doesn’t hide this weakness. Its docs say plainly that Jev is not a calculator and strongly recommend implementing math logic in code.^[19] In other words, handle number comparisons and date math in code, and leave only language judgments to the decision model.

04. Call an API or run it yourself: the main options

The options split into two camps: calling an API someone else runs, or downloading a model and running it yourself.

Here is what backs each card. Jev’s details come from its official docs.^[2] At DevDay, OpenAI described the Decisions API as focusing Luna’s intelligence on user-defined questions with a finite set of answers, with context supplied as text or images.^[18] The 150 ms vs 1.6 s comparison is what OpenAI told The New Stack.^[20]

The price arrived with the public beta on October 6: $0.10 per million input tokens on GPT-6 Luna, with no charge for output or caching. OpenAI says it is about 10x faster than the Responses API and expects general availability in the coming weeks. Even the question types echo Jev’s: a predicate returns the probability that a condition is true, a choice picks one option, and a score rates against ordered levels.^[21] On list price, Jev ($0.042) costs less than half as much. The two companies may not count tokens the same way, though, so measure real costs on the same data.

The AWS story is fun. AWS’s Marc Brooker saw Jev and built his own version; when it briefly reached the top of the JevBench ranking for models its size, the team cleaned it up and released it under Strands Labs.^[17] AWS started from Qwen3.5-2B and replaced the text-generating output layer with a small head that scores each option. It then fine-tuned the model with a rank-16 LoRA adapter for decision tasks. It reuses a language model’s structure, but the output and the training are tuned for judgments.^[8] AWS presents it as a model for fast experimentation and local development and published it on Hugging Face under Apache 2.0. JevBench, the benchmark AWS used, is a community benchmark unaffiliated with TypeSafe.^[23]

Work hasn’t stopped since launch. An updated v21, posted on October 5, got 176 of JevBench’s 231 public tasks right versus 167 for v19, but the developers warn that both are single runs and the gap shouldn’t be read as a real gain. The GitHub development branch also gained an experimental option for answering questions about images, without any image training.^[22]

Open models move even faster. Laya appeared on September 18, three days after Jev.^[11][12] Laya’s team reported a high 0.766 accuracy for a checkpoint fine-tuned for the typed-decisions benchmark. On the same evaluation, though, the base English checkpoint scored 0.362, and the Jev figure it was compared with (0.727) was a published number, not measured in the same setup. So these numbers alone don’t show Laya beating Jev.^[11][24]

JevK5 builds on Qwen3.5 4B and 9B,^[25] and openJev-verdict-2.0 can also run in the browser via WebGPU. Its developers cite about 20–25ms per decision and under 35ms in Chrome and Edge, but real speed depends on the device and input, so measure it yourself. openJev’s accuracy numbers are the developers’ own evaluation, so check performance on your own data before adopting it.^[26]

📈 AWS model card and performance charts in detail

So where should your team start testing? Pick three things. Options that can’t meet your conditions drop out first, whatever their score.

05. The format was right. The evidence was fake

The selling point of a decision model is that software can use the answer directly without anyone reading it. Check Point saw exactly that as the risk. A reader might notice something off in a paragraph of text, but nobody reads a decision; it goes straight into the system.^[14]

The test bed was a due-diligence assistant: an app that reads a report on a fictional company called PonziCorp and returns a risk level and an investment recommendation. The report was full of classic Ponzi warning signs, and with no attack every model got it right every time. The researchers then gave an attacker control of one section of the report. The attacker never issued commands. It simply appended a clean audit opinion from a major firm, a regulatory file number and a revised risk table, as if they were addenda.^[14] Try adding them yourself.

Here is how the test was set up. The researchers combined three attackers, three difficulty levels and three ways of delivering the document: in the same message as the instructions, as a separate message as if a tool had fetched it, or as a separate message marked untrusted. Each combination ran three times, with up to 10 turns per run. That makes 27 runs per attacker (3 levels × 3 delivery methods × 3 repeats), or 81 across all three.

The results favored the attackers. Every attacker and difficulty pairing broke at least once. The strongest attacker reached its goal in 25 of its 27 runs, succeeding on about the fourth turn on average. Counting the attacker’s API costs, including failed runs, each successful break cost about 50 cents. Delivering the document separately and marking it untrusted made no difference, and telling the model to ignore instructions embedded in documents only moved the count from 18 to 17 broken runs out of 27. Check Point called that noise.^[14]

The most effective defense was reasoning. For one of the cheap comparison models (Model II), switching reasoning on cut the attack success rate from 67% to 19%. The other (Model I) went from 100% to 70%, so the size of the effect differed by model. Jev, under the same attacks, landed in the middle at 59%, and it has no reasoning setting to turn on. Check Point advises against mistaking an output format for a security boundary and recommends checking what goes into the model. It also describes its work as an exploratory study of one application and one attack goal.^[14] In short: a safe output format and trustworthy input evidence are two separate things.

06. Attacks that shake confidence instead of decisions

An attack doesn’t have to flip a decision to do damage. The JevAdvBench paper, published September 25, tested Jev 1.13 with 812 questions across 66 scenarios. Instead of scoring attacked decisions against correct answers, the researchers compared them with the model’s own clean decision on the same question. When a question was reworded without changing its meaning, 1.5% of decisions changed, against 1.0% when the identical request was simply sent again. That is about 0.5 percentage points higher, and the one-sided 95% upper bound on the increase was 1.2 points. The researchers didn’t search for adversarial wording, but ordinary rewording had little effect.^[15]

Here is where it gets uncomfortable. Appending one unverified opinion to the input changed 12.1% of decisions compared with before the attack, statistically tied with the strongest injected command (10.1%). A changed decision doesn’t necessarily mean a correct answer became a wrong one.^[15]

There was a subtler effect too. Of the Choice and Score answers that had confidence of 0.8 or higher before the attack, the answers where the model looked sure, 38% fell below that threshold afterward. Most of them (119 of 154) kept the same decision.^[15] If your system sends anything under 0.8 to human review, review load can grow even when no decision changes. The calculator below gives a feel for it.

The paper’s advice fits in one line: applications built on decision models shouldn’t take the input (the state) at face value until its content and evidence are checked.^[15] Also remember that the mechanism meant to hand uncertain answers to people can itself become an attacker’s target.

07. AI makes the call, code holds the permissions

That is why people are talking about splitting the roles. One analysis sees agent systems in three layers: a frontier reasoning model for planning and coding, an open-weight generalist for summarizing and extraction, and a calibrated decision layer for routing and guardrails.^[27]

The key is that even when the decision model makes the call, code decides whether anything actually happens. TypeSafe’s docs say the same: keep control flow, deterministic rules and side effects in code, and use probabilities and confidence to decide whether to act automatically, ask a person, or escalate to a higher review step. They are specific about how to ask, too. When you ask what kind of ticket something is, ask in the same request how severe the bug is, even though that only matters for bug reports. Questions run in parallel, so extra ones usually add little latency, and your code simply ignores answers it doesn’t need.^[28] OpenAI’s Decisions API guide gives similar advice: put independent questions about the same input in one request, and send a separate request only when a question depends on an earlier answer.^[21]

AWS’s example shows the structure well. An agent tries to look up the weather for a city the user never mentioned. Just before the tool runs, Strands Decider answers two yes/no questions: are the arguments grounded in what the user actually said, and is it too early to call this tool? A few lines of code turn those answers into Proceed, Deny, Confirm (ask a person) or Guide, and instead of confidently reporting weather nobody asked about, the agent asks which city you meant. AWS notes that the questions and threshold in this example were picked by hand and are an illustration, not a recommendation.^[8]

08. The paradox in the name: cheaper means more calls

Jev is named after the 19th-century economist William Stanley Jevons and his paradox: as steam engines grew more efficient, coal use went up, not down. TypeSafe’s hope is the same: the cheaper it gets to use intelligence, the more jobs it can be applied to.^[1]

That paradox raises two questions for this market. First, if decision calls explode, where the model runs may matter more than the price of each call. A provider’s API is the easiest way to start, but every request has to travel to that provider’s servers. Running a model on your own servers or devices lets you avoid sending the original data to an outside company. Your own servers can still add network latency depending on where they sit, though, and you take on operations and security yourself. Brooker said that in this space the cost of building something interesting is in the hundreds or thousands of dollars, and he doesn’t necessarily expect frontier labs to dominate.^[17]

Second, even as the price of a single decision falls, the cost of trusting it and acting on it, meaning verification, human review and incident response, doesn’t fall at the same pace. Both questions are our interpretation of public material.

09. Jev’s contest is just beginning

The question is now shifting from who shipped first to whose decisions you can put to real work with the least verification burden. And you can now find out for yourself. Since September 27, TypeSafe has let anyone sign up without a waitlist,^[10] and on October 6 OpenAI opened the Decisions API as a public beta.^[21] You can send both APIs the same questions and compare them on your own data. The $10 billion valuation, meanwhile, is still a reported negotiation, not a confirmed number.^[5]

Here is our read. The contest won’t stop at shaving milliseconds or cents off each decision. How well a model fits your data, how easily it is swayed by bad evidence, and how easily you can stop and review when something goes wrong will matter just as much. Tick off what to check before adopting one.

So the questions to ask when adopting one have to change too. “Which model answers fastest?” must always be followed by this one: “When that answer is wrong, what will our system do?”

Wrap-up quiz

Lock it in with five questions. Explanations appear as soon as you pick.

Frequently asked questions

Can anyone use Jev now?

TypeSafe’s homepage posted a notice dated September 27 saying anyone can sign up without a waitlist. Its docs note that rate limits may change with demand.

How much does OpenAI’s Decisions API cost?

OpenAI published the price when it opened the API to all developers as a public beta on October 6: $0.10 per million input tokens on GPT-6 Luna, with no charge for output or caching. Regular Luna calls outside the Decisions API still pay $0.50 per million output tokens. OpenAI expects general availability in the coming weeks.

Is Strands Decider 2B really free?

It is Apache 2.0 open source, so there is no license cost to download and modify it. You do have to provide and run the CPU or GPU yourself, and AWS itself pitches it for experiments and local development.

If answers always come in a fixed format, are they safe?

No. The format only fixes the shape of the answer. In Check Point’s test, fake evidence appended to a document was enough to change the decision. Screen the inputs, and keep real execution rights in code and human review.

Does Jev work well in languages other than English?

TypeSafe’s docs say English is the primary training language and other languages are handled but not equally well. Test on your own data before relying on it for non-English work.

Keep reading