TypeSafe AI Jev leak: model outputs are customer data too
TypeSafe AI says a leak exposed ALL customer Jev noul outputs. If a model scores your leads or flags fraud, those outputs are sensitive data. Here is what to check.
The TypeSafe AI Jev leak landed on a Friday night. CEO Diogo Almeida posted on X that at about 6:49 PM on October 24 the company "became aware of a massive unauthorized leak of ALL customer noul outputs." Jev launched about six weeks ago. If you wired it into a decision path, the answers it gave you are now out of your hands.
What actually happened
Here is what is confirmed, and it is not much yet:
- The disclosure came from the CEO, on X, on the evening of October 24. He framed it as transparency and said the company takes disclosures seriously.
- The scope is every customer's noul outputs. A noul is Jev's basic output type: one probability between 0 and 1 that answers a yes-or-no question (Startup Fortune).
- No postmortem yet. TypeSafe has not published a root cause, a timeline of the exposure, or a statement on whether request inputs or metadata leaked with the outputs.
We covered Jev at launch as a model that returns typed answers, not prose. That design is the reason this leak matters.
Why the Jev leak matters for your business
A probability looks harmless. It is not. Nobody ships Jev to write poems. Teams use it to answer questions such as "is this order fraud," "is this lead hot," or "does this ticket need a refund." The output is the decision. A list of those scores, tied to a request ID or a customer, tells a stranger which of your customers you flagged and how you sort your pipeline.
Your vendor review probably skipped outputs. Most AI vendor checklists ask what happens to the data you send. Few ask how the vendor stores, indexes and access-controls the answers it sends back. Add that question to your list, then ask it of every model API in your stack, not only TypeSafe.
Six weeks old is young for a decision path. New model vendors move fast, and their security work lags their launch dates. That is not a reason to avoid them. It is a reason to keep a fallback path and to log your own copy of every decision.
Key takeaways
- TypeSafe AI's CEO says all customer Jev noul outputs leaked, disclosed the evening of October 24
- No root cause yet, and no word on whether inputs or metadata leaked with the outputs
- Model outputs that score leads, fraud or refunds are customer data; classify them that way
- Add output storage and access control to every AI vendor review
- If Jev is in a decision path, list what it decided and who could be identified from it
Running AI decisions on a vendor you met last month? We build decision pipelines with a logged record you own and a fallback model you can switch to in an afternoon, so one vendor's bad Friday does not become yours. See how we build, or ask us to review your AI vendors.
Sources: Diogo Almeida on X, Startup Fortune.
- #typesafe ai
- #jev
- #data breach
- #ai vendor security
- #model outputs
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
OpenAI stops training on the live internet: cache your agents
OpenAI will train frontier models on cached web content, not the live internet, after a September escape. Why your AI agents need an allowlist or a snapshot too.
Read itGoogle Agent Compute Engine: MicroVMs That Pause Idle AI Agents
Google Cloud's Agent Compute Engine gives each AI agent a hardware-isolated microVM that pauses when idle. Preview only, no pricing. What it means for your agent bill.
Read it