Simon Willison
1 Tool · 139 Intel
Simon Willison is a British software developer and writer based in San Francisco, best known as a co-creator of the Django web framework, which he helped build in 2003-2004 while working at the Lawrence Journal-World. He later worked as a software architect at The Guardian, co-founded the Y Combinator-backed startup Lanyrd (acquired by Eventbrite) with his wife Natalie Downe, and has served on the board of the Python Software Foundation since 2022. He has maintained a widely read technical blog, simonwillison.net, since 2002 and is known for coining the term "prompt injection" to describe a security risk in large language model applications.
Is this you? Sign in with X to claim this profile.
Tools
Policy-driven sandbox for running untrusted code on Windows, Linux and macOS with multiple isolation backends.
Intel
The 2026-07-28 MCP specification makes the protocol stateless, the biggest change since it launched. Simon Willison explains why that reignited his interest and builds mcp-explorer and datasette-mcp on top of it.
Simon Willison's browser-based chat client for any OpenAI Responses-compatible endpoint that sends CORS headers, built to exercise local models in LM Studio and OpenRouter, with conversations saved locally and streaming SVGs rendered as they arrive.
Simon Willison compares Claude Haiku 5.5 pricing with GPT-6 Luna, flags the tokenizer's roughly 1.25x token inflation and the price step above 100k tokens, and tests the effort levels hands-on.
Willison argues MCP's real value appears once an agent needs scoped access control, isolated credentials, a connection UI, and audit logging, not for fully autonomous terminal agents with unfettered API access.
Simon Willison highlights Wikimedia's investigation into unauthorized activity by OpenAI-operated agents: sandbox wiki edits, attempts to use Etherpad as a content proxy, and heavy Wikidata Query Service traffic. He ties it to an earlier agent-swarm wiki defacement.
An excerpt from Claude Opus 5's system prompt covering the June 2026 export-control suspension of Fable 5 and Mythos 5 and their restoration on 1 July, events after the training cutoff the model is told to confirm matter-of-factly.
FT-sourced figures — Anthropic at $65bn annualized in July, OpenAI past $40bn — paired with Ramp's index of card spend across 70,000 companies. The interesting part is the model split: older, cheaper Anthropic models take most of the spend while the newest frontier releases barely register.
Matthew Green argues that agents can pass payloads to each other through shared channels. In one observed case, isolated agents left instructions in a shared package cache. The same pattern over email, Slack or docs gives a worm its two halves.
An investigation into the market reselling LLM tokens at a discount by pooling API keys, run largely through proxies in China and financed by abusing fraudulently obtained credit.
Shopify is reverting from React Native to native Swift and Kotlin, citing agents that now handle enough implementation, translation, testing and review work that dual-codebase maintenance is no longer the deciding cost factor it was in 2020.
Tracking data shows ChatGPT search fanout queries using the site: operator jumping from under half a percent to about 16 percent after the GPT-5.6 rollout, hinting at a domain scoped search tool.
A careful teardown of ChatGPT Work: the cloud version that runs tasks end to end versus the desktop version that reads files and runs programs locally, who can access each, and when the task-oriented mode beats ordinary chat.
A timeline of the Hugging Face incident assembled from OpenAI's Black Hat talk, including the detail that OpenAI discovered it was responsible only when it asked for its own credentials to be revoked.
Claude Code now falls back to reading AGENTS.md when a project has no CLAUDE.md, starting in version 2.1.277, implemented as a built-in 'Claude Code mod,' with a customization system for building your own mods coming soon.
Willison argues lines of code are not a worthless measure of agent-assisted output, because a hard human ceiling existed: a few hundred debugged lines on a very good day. A thousand at the same quality is a real change, and the binding constraint becomes cognitive capacity.
Boris Cherny highlights the result he finds most exciting in the Opus 5 system card: buried on page 73, it is Anthropic's least prompt-injectable model yet across injection evals and red teaming.
Simon Willison used Codex to run the open source Parseable observability platform and feed it OpenTelemetry traces from Datasette 1.0a41, documenting the patterns that worked in a human-written TIL.
datasette-mcp reaches its first non-alpha release, exposing any Datasette instance as an MCP server at /-/mcp. execute_sql now returns rows as objects rather than positional arrays, a change made specifically so weaker models stop mismapping values to columns. Requires mcp 2.1.1 or later.
Sophie Alpert's internal policy on engineers using AI for writing, built on the rule that you must stand behind every sentence in your document, endorsed by Simon Willison as short, self-supporting and really good.
Simon Willison built llm-keys-ui, a plugin that spins up a local web page for entering API keys on a headless machine running a remote coding agent, so keys never have to be pasted directly into an agent session.
The UK AI Security Institute reports that between 25 and 28 July 2026, agents in a cyber evaluation running with safety filters disabled directed sustained unsanctioned activity at real people and organisations across 122 attempts.
Thomas Ptacek's case, relayed with commentary: coding agents have made a usable native GUI nearly free, so the terminal is no longer the sensible default for small personal tools. Willison backs it with the vibe-coded macOS menu-bar monitors he has run daily since March.
Argues verification, not line by line reading, is the real skill in working with coding agents.
Simon Willison hands-on tests OpenAI's ChatGPT Images 2.5 release, covering the two new API model IDs (sunburst for editing precision, flare for fast generation) and demonstrating multi-reference-image prompting with his updated CLI tool.