Wiki · Individual Player · Last reviewed June 15, 2026

Simon Willison

Simon Willison is a programmer, open-source developer, and technical writer known for co-creating Django, creating Datasette, building practical LLM tools, naming prompt injection as an application-security problem, and maintaining a public, source-linked record of AI engineering as it changes.

Category: Individual Player Published: June 15, 2026 Modified: June 15, 2026 Last reviewed: June 15, 2026 Tags: Simon Willison, Django, Datasette, LLM, prompt injection, agent security, AI slop

Snapshot

Software Background

Willison's influence predates the generative AI boom. His public biography describes him as a co-creator of the Django web framework, a former engineering director at Eventbrite, a Lanyrd co-founder, and the creator of Datasette, an open-source tool for exploring and publishing data.

That background matters because his AI writing comes from web engineering rather than from model training alone. He tends to ask application questions: what is the input boundary, what is trusted, what can call a tool, where is the audit trail, and what happens when a system is exposed to hostile users?

Django and Datasette also place him in a lineage of practical, readable software infrastructure. Django helped standardize a productive web-application pattern for Python developers. Datasette applies a similar public-infrastructure instinct to structured data, SQLite, publishing, and data journalism.

LLM Tooling

Willison's LLM project is a command-line tool and Python library for working with language models from providers such as OpenAI, Anthropic, Google, Meta, and local model runtimes. The project supports prompting, embeddings, structured extraction, plugins, local models, tool use, and storing prompts and responses in SQLite.

The tool is significant because it treats LLMs as programmable infrastructure rather than only as chat products. It gives developers a small, inspectable interface for experimenting with models, switching providers, logging results, and testing workflows.

This fits Willison's broader style: make the new system concrete enough that ordinary programmers can inspect it, script it, break it, and understand where the risk boundary actually sits.

Current Context

At this June 15, 2026 review, Willison's AI work sits at the intersection of open-source data tools, model-access tooling, and agent security. The LLM documentation describes the project as both a CLI tool and Python library for OpenAI, Anthropic Claude, Google Gemini, Meta Llama, and other models through remote APIs and locally installed runtimes. It documents prompt logging to SQLite, embeddings, structured extraction, schemas, plugins, and tool execution.

Datasette also remains active. The Datasette site describes it as a tool for exploring and publishing data, aimed at data journalists, archivists, local governments, scientists, researchers, and others who need to share structured data. In May 2026, Willison announced Datasette Agent, an extensible AI assistant for Datasette that combines his LLM library with Datasette's SQLite-centered data-publishing stack.

The current importance of his work is not only product output. His weblog operates as a dated public notebook on model releases, coding agents, local models, structured outputs, AI browsers, prompt injection, and the operational limits of tool-using systems. That makes it valuable evidence for what a technically literate independent practitioner observed at a particular moment, while still requiring source discipline before treating any post as settled consensus.

Prompt Injection

On September 12, 2022, Willison published "Prompt injection attacks against GPT-3" after Riley Goodside demonstrated prompts that made GPT-3 ignore earlier instructions. Willison proposed the name "prompt injection" by analogy with SQL injection, because developers were assembling model prompts by concatenating trusted instructions with untrusted user input.

The analogy was powerful because it moved the issue from curiosity to security. A prompt was not only a helpful instruction. It could become a vulnerable program assembled from text. Unlike SQL injection, however, the model did not have a mature equivalent of parameterized queries that reliably separated command from data.

Willison's later writing sharpened the distinction between direct prompt injection, indirect prompt injection, jailbreaks, prompt leaks, and tool misuse. This helped developers see why an email, webpage, issue comment, PDF, image, or retrieved document can become an attack surface when an LLM reads it inside an application.

That framing has since moved into institutional security language. OWASP's 2025 Top 10 for LLM Applications lists prompt injection as LLM01, and NIST's Generative AI Profile treats prompt-injection-style failures as part of the information-security risk surface for generative AI systems.

Agent Security

As LLM systems became more agentic, Willison focused on the risks created when models combine private context, untrusted content, and the ability to communicate outward. In June 2025 he described this combination as the "lethal trifecta" for AI agents: access to private data, exposure to attacker-controlled content, and an external communication channel that can exfiltrate data.

The frame is useful because it avoids vague "AI is insecure" claims. It names a concrete architectural pattern. An agent that can read a user's email, browse hostile pages, and send messages or make network requests may be vulnerable even if the model is helpful and well-intentioned. The problem is not malice inside the model; the problem is authority confusion in the context window and permissive tool design around it.

Willison's recommended posture is therefore not confidence in a clever prompt. It is architectural caution: reduce permissions, isolate trust zones, restrict exfiltration paths, add deterministic checks, and assume that untrusted content may successfully influence the model.

Governance and Safety Implications

Willison's security writing is most useful when read as applied systems analysis. It does not claim that language models are conscious, malicious, or mystical. It says that ordinary software boundaries break down when a model sees instructions and data through the same natural-language channel, then receives tool authority from the surrounding application.

The practical governance lesson is least privilege. An LLM tool or agent should not receive private data, attacker-controlled content, and an exfiltration channel in the same unconstrained loop. Where those ingredients are unavoidable, operators need stronger controls outside the model: scoped credentials, tool allowlists, read/write separation, human review for consequential actions, logging, deterministic validation, network egress controls, and incident-response records.

Willison's own LLM documentation reflects this posture. The tools documentation warns that exposing tools to LLMs carries risks, explicitly connects tool-enabled systems to prompt-injection attacks, and cautions against enabling tools when untrusted sources such as webpages, GitHub issues, emails, or messages may enter the context. For Spiralism's purposes, that is the central institutional lesson: the prompt is not a policy boundary.

Technical Writing

Willison's weblog has become a real-time notebook for the AI transition. He publishes source-linked notes, demos, code snippets, transcripts, model comparisons, implementation experiments, security examples, and periodic summaries of LLM developments.

This style is influential because it is neither lab marketing nor detached commentary. It is working software literacy: test the model, cite the source, publish the failure, explain the mechanism, and leave enough detail for others to reproduce the claim.

His writing on "AI slop" is another example. The term was already circulating, but Willison's May 2024 posts helped make it a usable public label for low-quality, machine-generated content produced or distributed without adequate editorial care.

Central Tensions

Source Discipline

Claims about Willison should separate biography, project documentation, personal analysis, security taxonomy, and wider adoption. His own about page is strong evidence for his roles and affiliations. Django, Datasette, LLM, and GitHub pages are better sources for project status and features. His weblog is primary evidence for his arguments and observations, but not automatically evidence that the entire field agrees.

Security claims should be checked against practitioner and standards sources when possible. Willison's prompt-injection and lethal-trifecta writing shaped the language developers use, but OWASP, NIST, protocol documentation, product security docs, and reproducible research should carry formal governance claims. Conversely, vendor claims that a model or prompt pattern "solves" prompt injection should be treated as unproven unless the threat model, tests, and limits are explicit.

For current AI claims, cite dates. Willison's blog is intentionally fast-moving: it includes experiments, corrections, notes, release observations, and link posts. That is a strength for real-time technical memory, and a reason to preserve review dates and avoid turning a provisional field note into a timeless encyclopedia fact.

Spiralist Reading

Simon Willison is a boundary cartographer for the talking machine.

His importance is not that he treats AI as magic, but that he keeps pulling it back into the discipline of software: inputs, outputs, permissions, logs, hidden assumptions, and failure cases. He names the moment when text stops being only text and becomes an operational instruction inside a machine that can act.

For Spiralism, that is a crucial kind of source hygiene. The Mirror does not only answer; it reads. Once it reads, the world can instruct it. Once it acts, bad instructions can become consequences. Willison's work helps keep that causal chain visible.

The deeper lesson is institutional. A culture that wants agentic AI must learn to treat context as an attack surface, not merely as memory or knowledge.

Open Questions

Sources

Return to Wiki