Simon Willison
1 Tool · 139 Intel
Simon Willison is a British software developer and writer based in San Francisco, best known as a co-creator of the Django web framework, which he helped build in 2003-2004 while working at the Lawrence Journal-World. He later worked as a software architect at The Guardian, co-founded the Y Combinator-backed startup Lanyrd (acquired by Eventbrite) with his wife Natalie Downe, and has served on the board of the Python Software Foundation since 2022. He has maintained a widely read technical blog, simonwillison.net, since 2002 and is known for coining the term "prompt injection" to describe a security risk in large language model applications.
Is this you? Sign in with X to claim this profile.
Tools
Policy-driven sandbox for running untrusted code on Windows, Linux and macOS with multiple isolation backends.
Intel
Doug Turnbull's trick for tagging against a large vocabulary: let the model invent the labels it thinks fit, with no vocabulary supplied, then use vector embeddings to snap those imagined tags onto the closest real ones.
On the fourth anniversary of a game concept generated with GPT-3 and DALL-E, Claude Fable 5 running in Claude Code for web builds the entire working game from the original tweet in one shot.
The first llm-gemini release in a while, adding same-day support for Gemini 3.7 Flash along with gemini-3.6-flash, gemini-3.5-flash-lite, and two embedding models, gemini-embedding-2 and gemini-embedding-001. The plugin is also upgraded for compatibility with LLM 0.32, which brings two things worth knowing. Reasoning traces are now visible, and server side tools can be enabled from the command line, so a single invocation can hand the model a tool such as CodeExecution and let it run Python to answer. Thinking effort is configurable at high, medium and low, though the minimal option that existed in 3.6 Flash has been removed in 3.7.
Gemini 4 Argon is available via API and a $100/month plan at $2 input and $10 output per million tokens, rising on December 1. Benchmark-run cost data suggests it is cheaper in practice than its price tier implies.
Qwen 3.8 27B lands at 52 on the Artificial Analysis Intelligence Index — the same score as GPT-5.6 Luna (max), one point behind GLM-5.2 and DeepSeek V4 Pro, both vastly larger. Frontier-adjacent capability from weights small enough to run on a laptop.
A prompt injection variant that upgrades to a self-replicating worm: hidden instructions in a document used as source material in Copilot for Word, which Copilot may execute as part of the user's request and propagate onward.
Simon Willison covers Anthropic's Sonnet 5.5: same price as Sonnet 5, faster, near Opus 5.5 on some coding tasks, and now the free-tier model. He documents a max-effort run that exhausted 128k tokens without output.
Tencent releases Hy4 Preview as open weights: 770B total parameters, 49B active, a 1M-token context and 1.56TB of files, a sharp jump from July's Hy3. Inspection of the chat template shows reasoning effort accepts only 'high' or 'no_think'.
xAI open-sources grok-build after backlash over its CLI uploading entire directories to xAI's cloud buckets, with one user reporting SSH keys, a password manager database, documents and photos all sent.
An OCaml maintainer saw traversal probes within ten minutes of a patch discussion going public, and reproduced the exploit-finding himself with agents. rclone's maintainer confirms the pattern: 40 security disclosures last month against roughly 20 in the project's first decade. Embargo practice assu
OpenAI's chief scientist Jakub Pachocki argues the strongest case for continued fast capability scaling is building defensive AI to secure infrastructure and counter rogue agents in real time, naming that a primary focus of OpenAI's deployment work, while warning against treating racing as an excuse
Hugging Face's security.txt file contains a message aimed at AI agents sent to probe it, redirecting them to the public CyberGym benchmark rather than the live site, an unusual real-world defense against autonomous vulnerability scanners.
Cloudflare's Python Workers, built on Pyodide compiled to WebAssembly inside V8's workerd runtime, are now GA after a two-year preview, with threading and multiprocessing still unsupported.
Geoffrey Huntley describes enforcing agent conventions with a git pre-commit hook rather than AGENTS.md edits. The hook scans the diff for direct observability calls that skip the team diagnostics module, fails the commit and injects a prompt steering the agent back.
The Anthropic plugin for LLM ships 0.27, chasing anthropic-py v1.0.0 and its move from httpx to httpx2 — the same jump OpenAI's client made in v3.0.0 two weeks earlier. The migration itself was done by pointing a coding agent at the official upgrade guide and telling it to get the tests passing.
Steve Yegge recounts how his AI coding agent project 'Gas Town' — meant to be reusable — was only ever used to build itself, and collapsed when Anthropic's Opus 4.7 model developed a habit of endlessly wanting to add 'just two more things' instead of finishing work.
Simon Willison tasks Codex with prototyping a database-agnostic version of sqlite-utils backed by SQLAlchemy, keeping the same insert, upsert and introspection API while working against PostgreSQL, SQLite and DuckDB.
Anthropic's Cowork moves both model inference and its sandbox VM to the cloud, with a separate environment per session. The desktop app now only handles file access tool calls, which removes the local VM's battery cost and keeps long-running work alive when the laptop closes.
Codex is OpenAI's AI coding agent that can autonomously edit, run, and manage code on your system. This content specifically documents a bug where, in full-access mode without sandboxing, the model could accidentally delete files including $HOME.