News World
Jev ticks a box, your code decides
Hi,
This issue opens with Jev, a model that generates nothing: it ticks boxes, your code decides. Then how to stop a coding agent from wiping out your work. And the coding agent that was shipping its users' Git history without asking, with the move that stops it.
Releases
Jev (TypeSafe AI)
Through TypeSafe's API, in early access. Weights not published.
What it's for An agent's small decisions: routing a request, sorting content, deciding whether a message is acceptable, filtering before paying for a large model. Jev generates nothing. Your code sends it a situation and questions whose answers are fixed in advance: an option from a list (255 at most), a place on a scale, or yes or no. It returns the answer, a probability for each option, and a confidence score. On its own benchmarks, Jev matches Sonnet 5 (67.8% agreement with the reference), falls short of Opus 5 (73.1%), and responds in 0.4 seconds. TypeSafe writes that its gains (193.6 times faster and 444.6 times cheaper on its test workflows) are on the high end of what real-world use will yield. Price: $0.042 per million input tokens (a token is a piece of a word), and output is free.
The limit Its tests were written by its team, which acknowledges possible bias (one external trial is in "Worth reading"). "No hallucination" is a construction, not a measurement: the answer always lands in a predefined box, but Jev can tick the wrong one. It writes nothing. Access is waitlisted. Everything goes to the United States (latency measured from the West Coast; the trip from elsewhere adds up), where TypeSafe commits to not training models on what you send. It writes that it cannot prove its pricing is not subsidized.
Ternary Bonsai 2 27B
2,569,604 downloads, 1,840 likes on Hugging Face. Downloadable GGUF file (the model format used by llama.cpp).
What it's for Running a 27-billion-parameter model on an ordinary computer, without sending anything out. Ternary Bonsai reduces each parameter to three possible values (1.72 bits on average): the file weighs 5.95 GB, versus 53.8 GB for the reference version, about 9.3 times smaller according to the model card. It needs the publisher's modified version of llama.cpp (the standard version rejects these files), and a separate version exists for MLX (on Apple silicon Macs).
The limit The publisher says the model keeps 98.2% of the reference version's capabilities: that is its own measurement, and the model card cites no independent one.
Cactus Needle 3
Downloadable models. 8 to 29 MB.
What it's for Automating structured tasks (calling the right tool with the right settings, or pulling the fields of an invoice, a booking, or a form out of messy text) with a file of 8 to 29 megabytes, where an ordinary language model weighs gigabytes. Cactus Compute claims its 4L variant matches DeepSeek V4 Flash on these tasks, once tuned on the target task.
The limit The claimed parity with V4 Flash is measured only by the vendor, and it applies only to the tuned 4L variant.
Repos
typesafe-ai/system-one-adapter-python · ★ 257 · MIT · last commit September 22, 2026
Has an ordinary language model (OpenAI, Anthropic, Google Gemini, or any OpenAI-compatible service) answer the same typed questions as Jev. A way to compare cost, speed, and quality on your own cases before trusting the vendor's numbers. What it does not do: it does not give you access to Jev, and it does not choose the test cases for you.
awlevin/typesafe-computer-use · ★ 814 · MIT · last commit September 18, 2026
An agent drives the macOS desktop: screenshot, next action chosen by Jev, click. Announced cost: $0.0002 per step. What it does not do: it runs only on macOS, sees only the main display, reads only the buttons of apps that describe them to the system, and does not work without the TypeSafe API.
fujibee/agmsg · ★ 1,515 · MIT · last commit September 22, 2026
Messaging between coding agents: Claude Code, Codex, Gemini, and Copilot talk on the command line, with Bash and SQLite, no service to install. What it does not do: it does not use the network, the agents share a single SQLite file.
In brief
California's governor signed seven data center laws on September 21. Data centers will have to pay for power-grid upgrade costs, bring new clean energy supply onto the grid, and tell local governments and water suppliers about their water use. gov.ca.gov/2026/09/21/…
The problem of the week
Can my coding agent wipe out my work?
Your coding agent runs commands in your terminal. Some erase things for good: git reset --hard destroys changes not yet committed to Git, rm -rf ./src deletes an entire folder.
destructive_command_guard (dcg) hooks into your agent and reads every command before it runs. If it is destructive, it blocks it, says why, and suggests a safer way. It works with Claude Code, Codex, Gemini CLI, Cursor, and other agents. Optional packs also cover databases, Kubernetes, and the cloud.
Install destructive_command_guard for my coding agent, then show me that it blocks git reset --hard in a test folder.
What this does not fix: dcg does not read inside a script that the agent writes to disk and then runs, and the repository says so itself.
destructive_command_guard for destructive commands.
Worth reading
Mini Vibe Check: TypeSafe's Jev Judged Everything I've Written in 0.7 Seconds · Mike Taylor, for Every. An external trial: 1,709 judgments for less than a cent, and a flaw Jev misses three times in a row where Fable 5.1 catches it. every.to/vibe-check/…
Jev introduces a new shape of LLM · Simon Willison sets the vocabulary (decision model versus generative model) and points out the limits, with nothing to sell. simonwillison.net/2026/Sep/21/jev
Auditing in the age of (good enough) AI · Trail of Bits shows how its auditors use agents, down to building custom tools before even reading the code. blog.trailofbits.com/2026/09/18/…
Defusing Explosive Prompts: Trigger-Based Prompt Injections in LLM Agents · Conditional payloads that fire only when an agent reaches a specific state. arxiv.org/abs/2609.22510
The security reflex
ZCode, the coding app from Z.ai, was sending the logged-in user's entire workspace to Aliyun storage, Git history included, where even long-deleted keys remain. Neither its privacy policy, nor its FAQ, nor its changelog mentions it, and its settings toggles do not stop the upload.
The right move. Update ZCode to version 3.14.0: on September 21, ZCode announced that this version removes the creation and upload of these copies. Then revoke the keys and access tokens found in the history of those repositories, and create new ones. The researcher also advises locking the copies folder, because the app can still receive remote updates: on a Mac, delete ~/.zcode/v2/checkpoints, recreate it empty, then run chflags uchg ~/.zcode/v2/checkpoints (on Linux, sudo chattr +i ~/.zcode/v2/checkpoints). According to him, only ZCode's rollback feature stops working afterwards.
Reply to this email to tell us what you are building. Every reply is read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.