The Pulse
TypeSafe’s ‘Jev Leak’ Was a List of 101 Probabilities
A GitHub Gist linked in a post by TypeSafe founder Diogo Almeida contains values from 0.00 to 1.00 in hundredth-step increments, but no customer identifiers or individual output records. The post describes a leak discovered “this Friday eve
AI.info Team · Written with AI · fact-checked ·
A GitHub Gist linked in a post by TypeSafe founder Diogo Almeida contains a sequence of 101 numbers, from 0.00 to 1.00 in increments of 0.01. It does not contain customer names, prompts, identifiers or individual output records. The post describes the sequence as every customer’s leaked Jev output, but the file itself does not show that any of its values came from a customer or from an actual model response.
despite the unfortunate timing, we take disclosures seriously at @typesafeai at approximately 6:49PM this Friday evening, we became aware of a massive unauthorized leak of ALL customer noul outputs in effort to maximize transparency, here is the link:
Diogo Almeida, founder of TypeSafe AI
The post is dated October 24, 2026, a Saturday, while its text says the company became aware of the leak “this Friday evening.” The date and wording do not match. The post does not explain that discrepancy. Its linked Gist, titled outputs.json, was created on October 24, according to GitHub.
The linked file is a sequence, not a set of customer records
The Gist consists of a JSON array: 0.00, 0.01, 0.02, continuing by hundredths through 1.00. Counting both endpoints gives 101 values. There are no names, request identifiers, prompts, timestamps or other fields connecting a number to a user, customer or model query.
That is what the file establishes. Its contents resemble the range of probabilities a system might return, but the array does not show that these values were returned by Jev, much less that they were returned for customers. Nor does the absence of customer records in this Gist, by itself, establish whether TypeSafe experienced a separate security incident.
What “noul” means in the documentation
TypeSafe’s API documentation describes a noul question as a way to ask whether a statement is true. In the example response, the answer is a probability, such as 0.98, alongside the question type. That makes a probability a plausible kind of Jev output, but does not make a bare list of possible probability values a record of customer answers.
The distinction is between a possible answer format and evidence of actual responses. A number such as 0.67, without the question, input or an identifier tying it to a request, does not reveal what Jev assessed or whose data it concerned. The Gist provides no such context. The post’s description of “ALL customer noul outputs” is therefore not supported by the artifact it links.
What TypeSafe says Jev does
In a September 15, 2026, company blog post introducing Jev, TypeSafe describes the model as producing structured decisions for software, rather than conversational text. The company says those decisions can include probabilities and confidence scores. Its documentation likewise shows requests containing supplied content and one or more questions, with answers returned under the corresponding question names.
This product description explains why a list of probabilities could be presented as a Jev output. It does not authenticate the Gist as an export of model results. The file contains only the numbers; it does not include the inputs and questions the documentation associates with a request, or any customer-specific record.
What the post and file establish
The post makes an alarming claim and links to a file that contains a simple numerical sequence. The mismatch is visible in the primary evidence: the Gist has no customer-level information, and its values alone cannot demonstrate that a breach occurred or that customer outputs were exposed. The wording also calls the stated discovery time Friday evening even though the post’s date, October 24, 2026, was a Saturday.
Accordingly, the linked artifact is a list of 101 probability values, not evidence of a customer-by-customer Jev output dump. The Gist does not establish whether any separate incident took place; it simply does not substantiate the leak claim made in the post.