@simon-willison · 57 positions · 2 changes of mind · On ppll ↗
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
Simon Willison did not write this page.
We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording.
Their own site.
Is this you? Claim it or ask us to remove it.Or tell us what is wrong here.
Each column is a stretch of time in which the same views came up; a new column starts when one appears or goes quiet. Quiet means nothing on it in our sources for that stretch, which is not the same as a change of mind; Dropped means they said they no longer hold it; tap the card for which claim and when. Revised means the view carries on but one of its claims was dropped. Each row is one view, in the same place all the way along. The number is how many claims in that stretch; we hold 5 in 2025, 66 in 2026.
Prompt injection has no fix, so an agent has to be limited by what it can reach, not trusted to resist
Our label. 6 claims in Simon Willison's own words.
Their wordsSo, I think the most important thing is sandboxing. You want your coding agent running in an environment where if something goes completely wrong, if somebody gets malicious instructions to it, that the damage is greatly limited.
Their wordsThe problem with language models is they're incredibly gullible by design. Like, language models do exactly what you tell them to do, and they will believe almost anything that you say to them.
Simon WillisonCo-creator of Django and creator of DatasetteI REALLY want to believe that this fixes prompt injection risks for coding agents, but I'm just not there yet↗@simonw on Xx.com · 8 Aug 2026
Their wordsI REALLY want to believe that this fixes prompt injection risks for coding agents, but I'm just not there yet
Their wordsAnd what you can do if you've got one of these conformance suites is you can give it to a a good agent and say, "Write code until this test suite passes." And it kind of will.
Their wordsjust cuz the test suite passes doesn't mean that the web server will boot. You know, there's there's always a chance that when you actually try in the real world, something's not going to work.
Their wordsI think Opus 4.5 was the first one that earned my trust. Like I'm very confident now that for classes of problems that I've seen it tackle before, it's not going to do anything stupid.
Their wordsif you've always stuck to two programming languages because of the overhead of learning a third, go and learn a third right now. And don't learn it, just start writing code in it.
Their wordsone of the magic tricks about these things is that they they're incredibly consistent. If you've got a code base with a bunch of patterns in, they will follow those patterns almost to a T.
Their wordsI think that might be what saves us. I think the fact that no, you can't have one engineer and have him do a thousand projects because after three hours of that he's going to literally pass out in a corner.
Simon WillisonCo-creator of Django and creator of DatasetteOur industry is destabilized in a way nobody’s experienced since the advent of the personal computer.↗@simonw on Xx.com · 26 Sept 2026
Their wordsOur industry is destabilized in a way nobody’s experienced since the advent of the personal computer.
Simon WillisonCo-creator of Django and creator of DatasetteIf that’s true there are two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it. Both of these are bad!↗OpenAI agents attacked RubyGems back in Maysimonwillison.net · 12 Sept 2026
Their wordsIf that’s true there are two options: After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems. They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it. Both of these are bad!
Their wordsGiven how tempting a target wikis are for rogue agent swarms, it's not a huge surprise that Wikipedia found evidence of that activity once they went looking
Their wordsFrustratingly, the actual code it ran and exact details of what it did weren’t visible to me in the ChatGPT UI. I see this lack of transparency is an anti-feature.
Simon WillisonCo-creator of Django and creator of DatasetteAny piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.↗Be alert: targeted attacks on prominent Rustaceanssimonwillison.net · 17 Sept 2026
Their wordsAny piece of software that depends on open source (which is almost every piece of software) has a network of human beings who are potential attack vectors - everyone with publishing rights to any of the packages in the dependency network for that software.
Their wordsI guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.
Their wordsprojects are flooded with junk contributions at the moment to the point that people are trying to convince GitHub to disable pull requests, which is something GitHub have never done.
Simon WillisonCo-creator of Django and creator of DatasetteEverything we do with frontier models today, in a few years we’ll be doing instantaneously and for free.↗@simonw on Xx.com · 26 Sept 2026
Their wordsEverything we do with frontier models today, in a few years we’ll be doing instantaneously and for free.
Simon WillisonCo-creator of Django and creator of DatasetteWhen you release the best model in the world, it’s going get knocked off that pedestal pretty quickly. The competition is so fierce that you won’t get a long time at the top↗2026 in LLMs (so far)simonwillison.net · 27 Sept 2026
Their wordsWhen you release the best model in the world, it’s going get knocked off that pedestal pretty quickly. The competition is so fierce that you won’t get a long time at the top
Their wordsIt's certainly not a Fable-class model, but it's great to see Mistral put out a model that's back to being maybe about 6 months behind the frontier.
Simon WillisonCo-creator of Django and creator of DatasetteThe rule to never use a turn of phrase suggested by an LLM feels good to me. The text has that weird smell to it, and it's also a good principle to help stay disciplined.↗How To Write With An LLMsimonwillison.net · 17 Sept 2026
Their wordsThe rule to never use a turn of phrase suggested by an LLM feels good to me. The text has that weird smell to it, and it's also a good principle to help stay disciplined.