Simon Willison

Open Source Developer & Writer — Independent Board Member — Python Software Foundation Engineering Director (former) — Eventbrite Co-creator (historical) — Django Project

Listen — profile

0:00 / 3:40

Profile

Simon Willison is what happens when a genuinely great software engineer decides that the most useful thing he can do with generative AI is write down exactly what he finds, every day, for years, without flinching. He is not a lab researcher, does not run a company, and has no model to sell you. He is an independent developer with a blog he’s been running since 2002 — and that blog has become, for a large slice of the working developer population, the single most reliable place to find out what large language models can actually do this week.

The résumé behind the blog matters. As a student on an industrial placement at the Lawrence Journal-World in 2003–2004, Willison co-created Django alongside Adrian Holovaty, Jacob Kaplan-Moss and Wilson Miner — a framework that still runs a meaningful fraction of the Python web. He went on to Yahoo, then to The Guardian as a software architect, then co-founded the conference directory Lanyrd with Natalie Downe in 2010 (Y Combinator-backed, acquired by Eventbrite in 2013, where he ended up an engineering director). Since leaving, he’s worked full-time in the open on Datasette, a tool for exploring and publishing SQLite data that grew out of data-journalism needs. He has served on the Python Software Foundation board since 2022.

What makes him essential to anyone building with AI is the llm CLI, released in April 2023. It is a small, sharp Unix tool — pipe text in, get a completion out, log everything to SQLite — and crucially it’s a plugin host rather than a wrapper around one vendor. That design choice is the whole philosophy in miniature: models are commodities, your tooling shouldn’t care which one you’re using, and every experiment should leave a queryable trace behind. He also gave the field two of its load-bearing pieces of vocabulary. He coined prompt injection in September 2022, naming the problem after SQL injection because it is the same problem — trusted instructions and untrusted content sharing one channel — and he has spent the years since pointing out, correctly and repeatedly, that nobody has actually solved it. In June 2025 he followed it with the lethal trifecta: private data access + exposure to untrusted content + the ability to communicate externally. Any agent with all three can be made to exfiltrate your data. It’s now standard framing in AI security work, and it holds up embarrassingly well against every new agent breach.

He’s also the person responsible for asking every new frontier model to generate an SVG of a pelican riding a bicycle — a deliberately silly informal benchmark from October 2024 that has become a genuine cultural fixture, partly because it’s a surprisingly honest probe of spatial reasoning and partly because labs can’t game a joke without looking ridiculous. As of 2026 he’s still independent, still posting near-daily, and has finally converged his two worlds: Datasette Agent, released in May 2026, is an extensible AI assistant sitting on top of Datasette, three years after llm began. For a developer learning this field, Willison is the antidote to both the hype cycle and the reflexive dismissal — read him not for predictions but for a meticulous record of what someone competent actually got working, and what broke.

Key Articles & Papers

Prompt injection attacks against GPT-3 2022 — The post that named the field's most persistent security problem, by analogy to SQL injection — still unsolved, and still the first thing to read before shipping an LLM feature. The lethal trifecta for AI agents: private data, untrusted content, and external communication 2025 — A three-part test for whether your agent can be talked into leaking your data — now the default vocabulary for reasoning about agent security. Large language models are having their Stable Diffusion moment 2023 — Written the week LLaMA weights escaped, this correctly called the arrival of capable local models and the innovation explosion that followed. Here's how I use LLMs to help me write code 2025 — The single most practical thing he has written: concrete workflow, training-cutoff-aware library choices, and why 'boring technology' beats novelty when an LLM is writing. Not all AI-assisted programming is vibe coding (but vibe coding rocks) 2025 — The definitional correction that rescued a useful term from becoming a synonym for all AI coding — vibe coding means not reading the code, and that's fine for throwaway work only. Vibe engineering 2025 — His counter-proposal: what it looks like when strong engineers use coding agents responsibly, with tests, review and architecture still firmly in human hands. Imitation intelligence — my PyCon US 2024 keynote 2024 — A full annotated argument for why LLMs are imitation rather than intelligence, and why the Python community is unusually well positioned to steer the technology. The last six months in LLMs, illustrated by pelicans on bicycles 2025 — The AI Engineer World's Fair keynote that made the pelican benchmark famous — the fastest way to catch up on a chaotic half-year of model releases. 2025: The year in LLMs 2025 — The third of his annual reviews, twenty-six sections covering reasoning models, agents, coding tools and the datacenter backlash — the best single-document orientation to the field. AI enthusiasts are in a race against time, AI skeptics are in a race against entropy 2026 — An unusually honest attempt to diagnose why the pro- and anti-AI camps have no shared reality, written by someone with skin in both arguments.

Videos

Controversies

Willison has no scandals to speak of, but he does occupy contested ground, and it’s worth understanding the objections.

Access and independence. He is routinely given pre-release previews of models from OpenAI, Anthropic, Google and Mistral, frequently under NDA or embargo. Critics have questioned whether that access shapes his coverage. His response is unusually transparent: he publishes a standing disclosure stating he takes no payment from LLM vendors, with a named exception — OpenAI paid for his time at a GPT-5 preview event used in a video, with no editorial control over what he subsequently wrote. He also discloses sponsorships (Fly.io for Datasette Cloud work, a 2023–24 Mozilla grant) and consulting engagements. Whether that’s sufficient is a fair question; the disclosure itself is more than most in his position offer.

Enthusiasm as endorsement. AI skeptics argue that documenting how well these tools work — energetically, daily, from a position of hard-won credibility — functions as marketing regardless of intent, and glosses over the environmental costs, labour displacement and training-data provenance issues that keep many developers away. Willison engages with this directly rather than dodging it: he was an early amplifier of “slop” as a term for low-quality generated content, has written on the datacenter backlash, and has explicitly catalogued the ethical and energy reasons developers refuse these tools. His stated position is that the technology is arriving whether or not he approves, and that accurate documentation serves people better than either boosterism or abstention. Reasonable people disagree.