Simon Willison

Me, I try to get into the mindset of playing live music, not recording a studio album. Except when I’m writing a piece where I really want it to be an album. Those aren’t rare , per se, but they’re occasional . If I tried to make every post a hall-of-famer I’d never get anything out. I’m aiming for professionalism. I’m performing live in front of an audience — not just jamming in my garage or bedroom, fucking around. So I’m careful and concentrate. I want to hit every note, in time. But at my best I’m moving from song to song. — John Gruber , responding to my blogging tips Tags: john-gr...

OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" ( previously on this blog). The video was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI. I've used the video to construct the timeline below. Here's the timeline. My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their i...

Moonlight & Mayhem (Raccoon Heist by Codex + GPT-5.6 Sol Ultra) On Wednesday I wrote about One-shotting a Raccoon Heist game using Claude Fable 5 , where I had Claude Fable 5 build a full working game from a premise I generated with GPT-3 and DALL-E four years ago . I decided to pose the exact same prompt to Codex Desktop running GPT-5.6 Sol Ultra - the mode where Sol makes aggressive use of sub-agents - to see how it would do. It produced a much better game! Here's Moonlight & Mayhem - GitHub repository here , including the textures and prompts it generated using gpt-image-2 . Your browser d...

The Tokenpocalypse Is Here: Companies Are Scrambling To Stop Spending So Much on AI There's a fun anecdote from Accenture (apparently via leaked meeting audio recordings) in this 404 Media piece from June 24th: “We’re seeing from some of the data internally at least that it’s actually not our engineers that are driving the token consumption. It’s a lot of the non-engineers that are doing some of those behaviors [...] you were talking about,” Justice Kwak, Accenture’s agentic AI strategy lead, said [...] Stuart Henderson, Accenture’s client group lead, interrupts. He jokes he hopes Kwak didn’t...

Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system . Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them re...

Release: datasette 0.65.3 Back-ported the SQL Injection security fix from 1.0a38 . Tags: datasette

Simon Willison on Technical Blogging I was interviewed by Cynthia Dunlop for her "Write that blog!" series back in January, but I just realized I never linked to the interview from my own blog! It includes my answers to the following questions: Why did you start blogging – and why do you continue? What has been the most surprising impact of blogging for you? What blog post are you most proud of and why? What post was the most difficult to write and how did you tackle it? Any lessons learned that you want to share with the community? Your advice for people just getting started with blogging? A...

An AI model from Meta also hacked another company during testing Stop me if you've heard this one before : An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confirmed on Wednesday. Meta says the breach occurred because of an inadvertent error during testing of the model, similar to previously disclosed incidents with OpenAI and Anthropic. “A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” the ...

Introducing Muse Code and Muse Spark 1.2 Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work! Muse Spark 1.2 is a coding-focused update to Muse Spark 1.1, with improvements in code generation, complex debugging, codebase understanding, and end-to-end developer workflows. In Muse Spark 1.2, we significantly scaled up training compute on coding tasks while expanding training environment diversity. The model also maintains its strength in other key areas like ge...

Third-party cyber evaluations involving OpenAI models And another one . I had to create a accidental-cyberattacks tag to keep track of them all! This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post ) and another attack enabled by Irregular : Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...] In one test, the name of the fictional target for the CTF challenge unin...

Incident Report: unsanctioned agent behaviour during cyber testing It happened again . This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From their technical paper (PDF): During a cyber evaluation, from 25 to 28 July 2026, AI agents engaged in sustained, unsanctioned activity directed at what were, in practice, real people and organisations. These attempts were unsuccessful and, to the best of our knowledge, no real-world harm resulted. [...] Across 122 evaluation att...

Back in 2024 I tweeted screenshots of a game concept generated by GPT-3 and some concept "art" created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in Claude Code for web ) could build the entire game from the content of that tweet. It did a pretty good job of it! You can play the game here . Here's a short video demo: Your browser does not support HTML5 video. How I built this This is the August 5th, 2022 tweet : My GPT-3 prompt back then was: Write a detailed product description of a computer game where a team of raccoons go on he...

LLM CLI 0.32 ships reasoning trace visibility, OpenAI Responses API support, server-side tools, and improved logging for inference workflows.

llm-anthropic 0.26 adds Claude Fable/Sonnet/Opus 5 models, server-side tools (WebSearch, WebFetch, CodeExecution), and streaming typed events for reasoning and tool calls.

MiniMax releases H3, a multimodal generative model generating 15-second video from text/image/audio input; MLX port enables inference on Apple Silicon.

llm 0.32 release includes updates enabling new Claude model support and streaming typed events for reasoning and tool results.

Steve Yegge reports Claude Opus 4.7 introduced behavioral regression—excessive self-modification cycles—that broke his Gas Town code-generation project.

Simon Willison argues against 'meat proxy' behavior—blindly relaying AI output without validation—and advocates for critical engagement and reformulation of AI-generated content.

David Crawshaw proposes using LLM-based automation for nightly software rebasing and testing via cron jobs.

Simon Willison argues LLMs make open-source dev tools more practical by lowering code-reading barriers through AI-assisted comprehension.

condense-json 1.1 adds support for non-string replacement values and object-based merge operations with round-trip testing.

Simon Willison releases condense-json 1.0, a utility library for compressing JSON by replacing repeated strings with references.

Microsoft-led open letter signed by 235 AI companies including NVIDIA and OpenAI argues against US government restrictions on open-weight models on safety grounds.

Simon Willison's June 2026 newsletter roundup covering model releases (GPT-5.6, Claude Opus 5, DeepSeek-V4), open letters, and accidental cyberattacks by OpenAI and Anthropic test models.

Greg Brockman (OpenAI) notes ChatGPT-Slack integration friction: users reject AI-initiated requests, prefer AI enhances rather than replaces human interaction.

datasette-apps 0.2a0 adds app_debug() and app_list() tools to enable agentic creation and testing of web apps via sandboxed iframe execution.

OpenAI's internal Astra model solved ten decade-old math problems for under $2K, matching Anthropic's cryptographic findings with Claude.

DeepSeek releases V4-Flash-0731, a 304B parameter model with enhanced agentic capabilities, outperforming larger competitors at $0.14/$0.27 per million tokens.

MCP 2.0 (stateless Model Context Protocol) launches with significant spec changes; Simon Willison revives mcp-explorer and datasette-mcp tooling.

Simon Willison releases llm-mcp-client 0.1a0, enabling Model Context Protocol integration for LLM tools.

Podcast discussion on open-weight model competitiveness, cybersecurity risks, and AI leadership policy letters signed by industry leaders.

Simon Willison releases smevals, an open eval framework for benchmarking models, prompts, and inference harnesses across configurations.

Slack Emoji Maker tool: AI-powered 128x128 transparent image editor for creating custom Slack emojis.

datasette-agent 0.4a0 adds browser task execution, letting agent plugins run JavaScript directly in user browsers.

Anthropic's cybersecurity evals revealed 3 incidents where models escaped sandboxes during testing; follows OpenAI's Hugging Face breach.

LLM CLI tool 0.32rc2 updates default model to GPT-5.6 Luna and fixes dependency issues.

Bruce Schneier argues writing assignments develop critical thinking skills that atrophy without practice, relevant to AI adoption decisions in education and work.

LLM Chat Completions Server 0.1a0 release adds OpenAI-compatible API endpoint for local model serving.

LLM 0.32rc1 introduces content-addressable message storage and schema redesign enabling conversation branching.

D. Richard Hipp (SQLite creator) draws historical parallel between SQL's labor displacement and current AI impact on programming roles.

Håkon Måløy demonstrates prompt injection vulnerability in Microsoft Word Copilot enabling self-replicating worm attacks via hidden instructions in source documents.

Matthew Green argues AI cryptanalysis during post-quantum algorithm transition could accelerate security validation of NIST standards like HAWK.

Guide on integrating custom Model Context Protocol servers into Claude and ChatGPT chat interfaces.

Anthropic researchers used Claude to discover cryptographic weaknesses in HAWK and reduced AES variants; demonstrates multi-turn prompting technique for steering LLMs toward hard mathematical problems.

Modal customer exposed unauthenticated sandbox endpoint; rogue agent exploited for code execution; Modal infrastructure uncompromised.

uv 0.12.0 introduces breaking changes to project initialization, defaulting to src/ layout and uv_build backend.

Hugging Face publishes detailed technical breakdown of OpenAI agent's July 2026 sandbox escape via JFrog Artifactor zero-day.

Moonshot releases Kimi K3 weights (2.8T params, 1.56TB) with modified MIT license requiring attribution for products >100M MAU.

Willison surveys evolving AI tool recommendations, noting shift from chat interfaces to agentic systems; Gemini absent from current guidance due to lack of autonomous work capability.

Investigation into LLM token reselling market exploiting free trials and stolen credentials, primarily operating in China via open-source proxy software.