korrents
Simon Willison

What Simon Willison thinks about prompt injection

@simon-willison · 29 positions · 0 changes of mind

Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.

Everything they publish, on ppll ↗

Simon Willison did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

2 dated positions, 2026, in their own words. Our reading of what Simon Willison has said — not written or endorsed by them.

2 positions so far — this page is not yet offered to search engines.

  1. Our readingAuto-mode does not yet convincingly fix prompt-injection risk for coding agents.

    Their wordsI REALLY want to believe that this fixes prompt injection risks for coding agents, but I'm just not there yet

    ↗@simonw on Xx.com

    coding agents

    Interesting
  2. 5 months earlier

  3. Our readingPrompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions.

    Their wordsProblem is, you can solve SQL injection by parameterizing your queries. You can't do that with LLMs.

    ↗Simon Willison: Engineering practices that make coding agents work - The Pragmatic Summityoutube.com 10th of 18 in this recording

    LLMs

    Interesting