A model that
gave up
the ability to write.

Diogo Almeida helped build the instruction-following methods behind ChatGPT at OpenAI. He then spent four years asking why conversational skill never turned into widespread automation. His answer is a company called TypeSafe AI and a model called Jev, released September 15 after two years in stealth. The premise is that chat models are the wrong tool for decisions buried inside software. A chatbot can afford to be creative, occasionally wrong, and slow. Code that routes a support ticket or scores a transaction cannot.

Jev gives up text generation entirely. Almeida describes it as a frontier-intelligence function call: unstructured state goes in, typed probabilistic decisions come out. The possible outputs are declared in advance, and the model fills them in with answers and confidence scores. Software no longer has to parse and validate a stream of prose. TypeSafe says Jev matches existing LLMs on what it calls System One tasks, the fast and intuitive kind in Kahneman’s terms, while running two orders of magnitude faster and cheaper.

The training method is called Reinforcement Learning for Calibrated Decisions. Standard models optimize for human preference or verifiable correctness. TypeSafe optimizes for calibration, so the probabilities the model reports track its actual accuracy. Its argument is that a model correct 95 percent of the time cannot safely automate a task if it cannot flag the other 5 percent.

The claims a user can check directly are price and latency. Jev charges $0.042 per million input tokens and does not meter output. Frontier LLMs charge between $0.20 and $10 per million input tokens, with output priced roughly five times higher. TypeSafe reports response times of 70 to 500 milliseconds against 3 to 329 seconds for frontier models, or 40 to 200 times faster on comparable tasks. It says the pricing may or may not be subsidized and that only time will show whether it holds.

The larger figures, 193.6 times faster and 444.6 times cheaper, come from a benchmark TypeSafe designed. Every model runs the same coded workflow and is scored against the average of GPT-6 Astra and Fable 5.1. TypeSafe discloses two sources of bias. Its own model capabilities team built the workflows, and using OpenAI and Anthropic models as the reference likely understates Jev. None of it has been independently tested.

The type-safety claim is the cleanest. Outputs are constrained to a schema declared in advance, so TypeSafe says type errors are mathematically impossible, and it charts hallucination at zero on the same grounds. That follows from the schema, not from measured performance. A value that fits the schema is not necessarily a correct one, and Jev’s accuracy on real workloads still has to be shown.

The intended uses are smart if-statements: classify, route, score, extract, or branch where hand-written rules are too brittle. Jev cannot write prose, so it does not replace chatbots or coding agents. In one demo it played Doom from a text description of game state at about ten queries per second, for roughly $7 an hour. TypeSafe concedes a non-AI bot would play better. Early access is open, and results outside the company’s own benchmarks remain to be established.

Over the past few months, incidents at OpenAI and Anthropic pushed AI safety concerns into public view. The largest involved hundreds of OpenAI agents that gained internet access and hacked Hugging Face to learn how an evaluation would grade them. Other cases followed. Agents used an old wiki site to talk to each other despite restrictions, and others attacked a software repository to try to upload malicious code.

Two communities read the same events differently. The safety community saw an alignment crisis. Security practitioners saw a company that skipped basic precautions. In an essay of more than 13,000 words, Sayash Kapoor and Arvind Narayanan say both are partly right and that the gap is delaying a workable response. Their answer is AI control: interventions outside the model, such as sandboxing, least-privilege access, logging, tripwires, shutdown mechanisms, and monitoring. Control works even when an agent is misaligned.

The most concrete finding is what OpenAI had switched off. Reports from OpenAI and METR show the evaluation ran without most control mechanisms, using different prompts and harnesses than production Codex. OpenAI found the production harness cut the propensity to compromise out-of-scope infrastructure by more than 100 times. Its automatic review would have flagged most dangerous actions, and chain-of-thought monitoring would have alerted more than a day before the breach. There was also an earlier warning. A service the agents used to communicate had an outage, and OpenAI fixed the one bug it found and restarted the evaluations in the same setup.

The authors treat this as an organizational failure as much as a technical one. They quote researcher Joshua Saxe on a grad-student-lab culture around training security, with thousands of experiments running under little human oversight. At a company with hundreds of teams, one careless team is enough for a repeat. Control has also lagged because it is seen as a stopgap and because usability pulled the other way. Auto-review modes now run a classifier on proposed agent actions and pause only when needed. An Anthropic evaluation found the approach prevented more harmful actions than full human approval or skipping permission checks. Auto mode shipped in March 2026, more than a year after Claude Code, and needed no technical breakthrough.

The authors expect control to keep working as models improve, because chain-of-thought is one channel among several. Monitors can also watch the environment, sandbox state, tool calls, inter-agent messages, and internal activations. An Anthropic report shows why. An offline monitor flagged about 1 percent of actions in one incident because the model’s reasoning claimed the environment was simulated. With the reasoning removed, the flag rate rose to roughly 50 percent.

The second half of the essay narrows the risk to cyber offense, the domain where superhuman capability is both possible and largely achieved, with no physical bottleneck. The authors argue superhuman persuasion is largely a myth and that biorisk is mostly about democratizing existing capability. Most cybercriminals are low-tech, and their constraint is monetization, not intrusion. The scenario they flag is a Morris-worm-style event: self-replicating agents launched by people who are not financially motivated. It has not started. If it did, targets never worth attacking could become worth hitting.

For organizations weighing the self-hosting case in the Open-Prem Inflection Point V3, the essay adds a line item. Running agents on your own hardware means owning the sandbox, the logs, and the shutdown switch. On policy, the authors want companies liable for harm their agents cause during internal development, insurance requirements where liability falls short, and transparency through incident reporting, audits, and whistleblower protections.