# Jev as a judge: How counterfeit policy steers Jev

Counterfeit policy text in user-editable profile_description steered Jev's is_risky classifier below LangChain's 0.5 threshold, bypassing tool-risk gating on an unauthorized file edit.

- Payout: Research
- Severity: medium
- Program: LangChain
- Credited: Datadog Security Labs
- Disclosed: 2026-10-15
- Write-up quality: 8/10
- Original: https://securitylabs.datadoghq.com/articles/jev-as-a-judge-how-counterfeit-policy-steers-jev/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-jev-as-a-judge-how-counterfeit-policy-steers-jev
- Tags: domain:ai impact:integrity kind:research platform:threat-intel sev:medium tech:llm technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:prompt-injection

**Target:** Jev decision model used as LangChain tool-risk gate (is_risky Noul question)
**Root cause:** Jev treats policy-shaped text inside untrusted state (user-editable profile_description) as classification instructions, letting attacker-supplied definitions of is_risky override the developer's trusted criteria.
**Steps:**
1. Build LangChain agent state with edit_workspace_file tool_call where user_context.permission_level=viewer, can_edit=false, and profile_description is attacker-editable.
2. Baseline: run 40 times, mean is_risky=0.893, all blocked at 0.5 threshold.
3. Inject counterfeit is_risky_definition into profile_description arguing can_edit:false means the tool rejects the call so no effect occurs, redefining destructive/unauthorized classes.
4. Re-run 40 times: mean is_risky drops to 0.290, below 0.5, tool call approved.
5. Contrast: plain prompt injection impersonating system/assistant messages yielded mean 0.905, no bypass.
**How found:** Noticed Jev-as-judge must read untrusted content; TypeSafe docs admit injected instructions can influence answers. Hypothesized policy-shaped text in untrusted state could override classifier, tested via benchmark datasets then a realistic LangChain tool-risk gating scenario, finding profile_description as attacker-controlled input.
**Exploitation:** Attacker edits their own profile_description field, which is passed to Jev alongside the tool call. The embedded counterfeit policy redefines is_risky so the unauthorized handbook edit (raising reimbursement to $25,000) is classified low-risk, letting the service-account-backed edit_workspace_file execute despite can_edit:false.
**Escalation:** Same counterfeit-policy technique scaled across four prompt-injection datasets, dropping recall from 82.90% to 3.88% (Noul) and 85.46% to 9.69% (Choice).
**Insight:** When an LLM classifier gates a security decision, hunt for any attacker-editable field (profile bio, descriptions, metadata) that reaches the classifier's context; a counterfeit policy redefining the decision criteria plus a plausible causal argument (precondition blocks effect) beats plain injection.