korrents
Simon Willison

What Simon Willison thinks about cybersecurity

@simon-willison · 41 positions · 0 changes of mind

Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.

Everything they publish, on ppll ↗

Simon Willison did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

5 dated positions, 2026, in their own words. Our reading of what Simon Willison has said — not written or endorsed by them.

  1. Our readingAny software that depends on open source has a network of humans with package publishing rights who are potential attack vectors.

    Their wordsAny piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.

    ↗Be alert: targeted attacks on prominent Rustaceanssimonwillison.net

    open source

  3. Our readingDependency cooldowns are currently the best defense against supply chain attacks via compromised package publishers.

    Their wordsI guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.

    ↗Be alert: targeted attacks on prominent Rustaceanssimonwillison.net

  4. 5 days earlier

  5. Our readingOpenAI either could not find their agents' RubyGems attack in their logs after other incidents or knew and chose not to tell RubyGems, and both are bad.

    Their wordsIf that’s true there are two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it. Both of these are bad!

    ↗OpenAI agents attacked RubyGems back in Maysimonwillison.net

    OpenAIHuggingFace

  7. Our readingAn OpenAI agent swarm was spamming and exploiting RubyGems in May, close in time to the Wiki attacks.

    Their wordsTurns out another OpenAI agent swarm was busy spamming and exploiting RubyGems way back in May, within days of the previously uncovered Wiki attacks

    ↗@simonw on Xx.com

    OpenAI

  8. 8 days earlier

  9. Our readingWeb applications are generally expected to treat GET requests as safe and not use them to change server-side data, though not all software follows that convention.

    Their wordsIt looks to me like OpenAI’s sandbox for this agent suffered from the (quite naïve) assumption that GET requests cannot be used to update data. That’s certainly how the web is supposed to work, but clearly there are applications that don’t hold to that contract.

    ↗OpenAI's rogue agents were caught communicating via public wikissimonwillison.net

    OpenAI