korrents
Simon Willison

What Simon Willison thinks about prompt injection

@simon-willison · 57 positions · On ppll ↗

Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.

Simon Willison did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

Filter prompt injection · Newest first
Topic
All 57coding agents 12LLMs 12Anthropic 11OpenAI 6cybersecurity 4design 4prompt injection 4software quality 4open source 3
12 more topics
taste 3vibe coding 3AI agents 2behavioural science 1benchmarks 1data centers 1energy 1HuggingFace 1innovation 1JavaScript 1journalism 1MCP 1
Sort
NewestOldest

Only Simon Willison on prompt injection. See everyone on prompt injection

4 dated positions, 2026, in their own words. Our reading of what Simon Willison has said — not written or endorsed by them.

4 positions so far — this page is not yet offered to search engines.

  1. Our readingAuto-mode does not yet convincingly fix prompt-injection risk for coding agents.

    coding agents

    Their wordsI REALLY want to believe that this fixes prompt injection risks for coding agents, but I'm just not there yet

    ↗@simonw on Xx.com

  2. 5 months earlier

  3. Our readingPrompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions.

    LLMs

    Their wordsProblem is, you can solve SQL injection by parameterizing your queries. You can't do that with LLMs.

    ↗Simon Willison: Engineering practices that make coding agents work - The Pragmatic Summityoutube.com 10th of 18 in this recording

  5. Our readingThe only guaranteed defence against a prompt-injection attack is to remove one of its three legs — private data, exposure to untrusted content, or a way to send data out.

    Their wordsI call it the lethal trifecta because the only guaranteed solution is to cut off one of the legs.

    ↗Simon Willison: Engineering practices that make coding agents work - The Pragmatic Summityoutube.com 11th of 18 in this recording

  7. Our readingSandboxing is the single most important protection for a coding agent, because it is the only one that bounds the damage when the agent is successfully tricked.

    Their wordsSo, I think the most important thing is sandboxing. You want your coding agent running in an environment where if something goes completely wrong, if somebody gets malicious instructions to it, that the damage is greatly limited.

    ↗Simon Willison: Engineering practices that make coding agents work - The Pragmatic Summityoutube.com 12th of 18 in this recording