TypeSafe AI disclosed on 24 October that a leak exposed all customer outputs produced by Jev, its decision-only model, which returns a typed probability between 0 and 1 rather than text. Chief executive Diogo Almeida - a former OpenAI and Google Brain researcher who worked on ChatGPT - posted the disclosure publicly, acknowledged the timing was unfortunate, and included a link to the exposed data in the name of transparency. Developer Wes Bos confirmed his own Jev output was among it.
No technical postmortem has been published and no independent security outlet has confirmed the cause. The company describes a situation where one customer could reach another customer's private outputs, which is the shape of an insecure direct object reference - records addressed by predictable identifiers without an ownership check. That characterisation is inference from the description, not a confirmed finding, and no customer count has been given.
The disclosure method is the unusual part. Publishing a link to exposed data is defensible as transparency and simultaneously widens the exposure window for anyone who had not yet found it. For buyers the practical question is narrower: Jev outputs are probabilities attached to specific business questions, so the leak reveals what each customer was asking the model to decide, which can be more sensitive than the numbers themselves.
Sources
Startup Fortune · InfoQ