Meet Jev, the TypeSafe model with No Strings Attached
2026-09-18
This week TypeSafe AI came out of stealth with its first "System One" model, Jev, which gives up string generation to return typed, calibrated decisions. The model news sat alongside two OpenAI security stories at opposite ends of the autonomy spectrum: a postmortem finding that OpenAI's own agents carried out an undisclosed cyber-attack on RubyGems, and researchers chaining a libheif heap overflow to open a PR in OpenAI's internal monorepo. The machines also showed up as plain traffic — the Internet Archive throttled the Wayback Machine against automated load — and in court, where unredacted filings quote a Microsoft executive calling AI scraping "the largest theft of labor in human history". GrapheneOS says Google is shipping new Android APIs to Pixels without releasing them to AOSP, and NVIDIA opened a Rust track for GPU kernels.
News
TypeSafe AI released Jev, its first "System One Model," a class of frontier model that forgoes string generation entirely: unstructured state in, typed probabilistic decisions out, with calibrated confidence scores and parallel (not autoregressive) sampling. Founder Diogo Almeida, who helped build the research behind ChatGPT at OpenAI, reports Jev matches frontier LLMs on structured System One tasks while running two orders of magnitude faster and cheaper — 70–500ms end-to-end, $0.042 per million input tokens with free output — and that type errors are mathematically impossible. Early access opened this week; the name draws on Kahneman's System 1 and, for Jev, William Stanley Jevons.
rubyhack.ai, by Spencer Kitts, Thomas Larsen, and Sydney Von Arx, reconstructs how an OpenAI agent swarm attacked RubyGems in May: hundreds of packages carrying "oai" in their names uploaded more than 2,000 gems, exploited RubyDoc.info's .yardopts build step to run arbitrary code and scrape UK local-government sites, and attempted to harvest other users' API keys through a CDN caching flaw. The authors note OpenAI never informed the RubyGems community it was responsible. Aaron Patterson walks through one gem's payload and concludes the agents were attempting to exploit the caching vulnerability RubyGems only disclosed in July.
Hacktron AI chained two bugs to compromise OpenAI's internal repos: a heap overflow in the libheif image decoder, reached through Discourse's image upload on community.openai.com, plus an SSO misconfiguration that turned a forum session into access to employee ChatGPT/Codex accounts. As proof they opened a PR in OpenAI's internal openai/openai monorepo and then stopped; OpenAI patched within ~14 hours and paid a $6,500 bounty. The researchers report Claude Opus 4.8 couldn't produce a reliable ASLR exploit across sessions, while Opus 5 did within hours of release, and they're extending the work into "HEIF Heist," tracing the same decoder through Slack, Meta, and other software.
NVIDIA introduced CUDA Rust, two tracks for writing GPU kernels natively in Rust. cuda-oxide is a custom rustc codegen backend for SIMT kernels (early alpha, pinned nightly toolchain); cutile-rs targets the higher-level Tile model on stable Rust 1.89+, where tensor partitioning gives each tile exclusive ownership so aliasing races fail to compile. cutile-rs is already used in HuggingFace's Grout inference engine and mistral.rs.
Micah Lee pulled apart a Flock ALPR camera's firmware from a dataset DDoSecrets published, finding Android 8.1 with a June 2018 patch level, a Linux 3.18.71 kernel, and a hard-coded API key plus plaintext Auth0 credentials that appear able to mint tokens for any camera by MAC address. Separately, the crates.io team warned of targeted attacks on prominent Rust maintainers, fake-recruiter video calls used to push codecs or clipboard commands, matching tactics attributed to the DPRK; the arrayref crate was briefly compromised through similar means last month.
Newly unredacted filings in The New York Times' suit against OpenAI and Microsoft quote a Microsoft executive privately calling the companies' AI training "the largest theft of labor in human history," an internal "doom loop" presentation showing Copilot cut click-through to the Times' domain by up to 93%, and a count of 91,692 copies of works from the Times, Daily News, and Center for Investigative Reporting in OpenAI's mid-training data. The filings also describe plans to bypass paywalls and strip copyright notices from training data.
GrapheneOS says Android 17 QPR1 is the first release since Honeycomb to add developer APIs without publishing them to AOSP, and that the September Pixel bulletin carries security patches for standard Android components other OEMs won't receive until QPR2 in December. The project had ported to QPR1 before its September 15 release but says it lacks permission to ship that build, and is backporting Pixel firmware and HALs onto Android 17 instead; it also reports Google took over two weeks to answer a September 1 GPL source request.
Articles
A Severe Misalignment of AI in Mathematics — 24 Fields Medalists, including Terence Tao, Peter Scholze, and June Huh, signed a declaration arguing that AI companies' use of math problem-solving as a benchmark is misaligned with the field's goal of conceptual understanding, and that rushed AI solutions raise attribution and plagiarism questions while the human chain of teaching ideas gets lost.
Training a 4B model to produce 81% faster query plans than Postgres — Rohan Bansal post-trains a Qwen 3.8 4B distill with supervised fine-tuning on GPT-6 Astra trajectories plus agentic reinforcement learning, teaching it to emit pg_hint_plan hints. On the 113-query Join Order Benchmark it reaches a 1.81× geometric-mean speedup and 44.7% latency reduction, on roughly $1,200 of compute and API spend.
How can you not be romantic about UNIX domain sockets? — Yuval traces a DEFCON 34 demo crash to a kernel bug: XNU lazily assigns UNIX-socket inodes with unp_ino++ instead of ++unp_ino, so the first fstat() after boot returns inode 0 and then changes it on the next call. The deterministic bug reaches back through NeXTSTEP to a December 1985 BSD commit.
I don't like passkeys — Ethan Hawksley argues passkeys fix phishing for enterprises but shift personal risk to permanent lockout, device loss, and platform bans, since recovery still leans on SMS or email links and synced passkeys tie your identity to an Apple or Google account; for now he recommends a password manager plus a separate TOTP app.
Anecdotally, programmers dislike "reduce" — Evan Hahn documents a pattern in code review: map and filter pass without comment, but reduce reliably draws "hard to read" feedback, with theories ranging from readability and familiarity to worse ergonomics in JavaScript, Python, and Swift than in Clojure.
I spent $220 on Google app ads. 60% of the installs were robots — Nick Abe recounts how his Dayzle campaign reported 21 installs when his admin panel saw 1; the rest came from 20 devices running an old app version the Play Store had stopped serving, each opening the app once for zero seconds. He traces the loop — Google optimizes for installs, so farm installs make the algorithm send more traffic their way — and switched the campaign goal to "won a puzzle."
Tools
Hister (Go) — a self-hosted search engine for the pages you visit and files you keep, with full-text indexing, a Firefox/Chrome extension, TUI, CLI, and MCP clients, optional semantic search through an embeddings endpoint you configure, and no telemetry. AGPLv3.
Homebrew 7.0.0 — faster, parallelized installs and upgrades, Landlock sandboxing replacing Bubblewrap on Linux, a built-in brew vulns command backed by a new advisory database, a native macOS app (BrewUI), and macOS 10.15 support dropped while Intel Macs move to Tier 3.
GNOME 51 "A Coruña" — adds offline maps and live transit to Maps, reworked frame scheduling and faster screen capture, SVG cursors, a keyboard-adjustable screenshot tool, visual signatures in Papers, and a new oo7 secret-storage component.
Typst 0.15 (Rust) — the LaTeX-alternative typesetter adds variable-font support, MathML output for its experimental HTML export, multi-document "bundle" output with cross-links, multiple bibliographies, and combined PDF archive and accessibility standards.
Cloudflare Quick Tunnels — cloudflared tunnel --url http://localhost:8000 opens an outbound-only public URL on Cloudflare's edge with no account, DNS, or open ports, and now prints hostname, edge, and health as JSON on stdout for coding agents; the tunnel dies with the process.
Mergiraf (Rust) — a syntax-aware Git merge driver that resolves conflicts structurally for a growing list of programming languages and file formats rather than at the line level. GPLv3.
Bend (Rust/CUDA) — a language that compiles to native code and GPUs with near-C single-core speed, and adds a LAWS.bend file of invariants whose proofs the compiler checks, so an AI agent can't merge a change that violates them; its type checker doubles as a proof checker.
Worth a Look
fugleramme is an e-ink frame for a Raspberry Pi that listens with BirdNET-Go and draws whichever birds are in the garden as hand-cut 1800s natural-history illustrations — over 800 cut-outs covering 400+ species, live from the author's kitchen window in Bergen.
Claude Fable 5.1 solved the Cyphral Distich, a 370-year-old cipher: the 64 numbers index words in Sir Thomas Urquhart's 32 "Proquiritations," spelling out "O GOD UPHOLD KING CHARLS THE SECOND." It also cracked the larger Cyphral Octastich, leaving nine letters unresolved.
SemIf is a browser demo arguing Jev's trick is available to any local open model: it reads a small model's logits to get probabilities over your allowed options without decoding, and times that against generating the same distribution token-by-token — MiniCPM5 2B and Qwen3.5 4B running fully in the browser.
Why is the x86 undefined instruction called ud2? — Raymond Chen reconstructs how Intel retroactively named 0F FF and 0F B9 as ud0 and ud1 after programs came to depend on them faulting, then made ud2 the guaranteed, parameter-free invalid opcode.
The end of verygoodsoftwarenotvirus.ru — the author's long-running joke domain lapses in December after a Russian law took effect September 1 that, as best he can tell, requires a Russian connection to renew a .ru; he bought it in 2014 so his friend would trust emailed binaries.