Simon Willison

Simon Willison is an independent open-source developer who created Datasette and LLM and co-created Django with Adrian Holovaty. His AI work combines tools for querying data and recording model experiments with explanations of their limitations and security risks. He proposed the name prompt injection in September 2022 and later developed the lethal trifecta framework for describing how tool-using agents can expose private information.[1][2][3][18][6][7]

Willison announced Datasette’s first public version on November 13, 2017. It exposes SQLite databases through browsable HTML pages and JSON APIs, with queries driven by URLs. His launch examples included FiveThirtyEight CSV collections, political-party data and a local Chrome-history database. The original design deliberately used immutable, read-only databases: users could submit SQL without changing the records, while database-content hashes in URLs allowed year-long caching, with changed data receiving a new URL.[3]

In his April 4, 2023 announcement of LLM, Willison described a tool he had released in the preceding weeks for running ChatGPT and GPT-4 prompts from the terminal and storing prompts and responses in SQLite. LLM now provides command-line and Python interfaces to remote APIs and locally installed models, with plugins extending its integrations. It also supports embeddings, structured extraction and tool execution. Stored conversations make experiments available for later inspection; a shared interface does not imply identical capabilities across providers.[18][4][5]

His March 2023 Datasette–ChatGPT plugin connected a natural-language question to an inspectable database query. Asked which Datasette plugins were most popular, ChatGPT generated SQL that sorted by GitHub stars and selected five results. Datasette returned JSON, which ChatGPT turned into an answer; the interface exposed the generated SQL. Readers could therefore see what “popular” meant. Willison also reported hallucinated answers despite database retrieval and said he could not guarantee that further prompting would suppress them.[8]ⁿ¹

Code Interpreter’s ability to write, run and revise code prompted Willison to reconsider Datasette’s direction. In a July 2023 Latent Space conversation, he said it accomplished capabilities on his roadmap for the next two years, leaving him asking, “what's my software for?” His response was to pursue a stronger combination of Datasette and language models. He also described becoming more ambitious with coding projects: execution let the model encounter errors and correct them, rather than merely hand him untested code.[15]

In “Prompt injection attacks against GPT-3”, published September 12, 2022, Willison credited Riley Goodside’s translation exploits and proposed the name prompt injection. His explanation centered on trusted application instructions sharing a model’s context with untrusted input. Text supplied for translation could instead tell the model to ignore the translation task or reveal the original prompt. Willison framed this as an application-security problem for developers building software around model responses.[6]

Willison initially considered whether separating instructions from data could provide a defense analogous to parameterized SQL, while acknowledging uncertainty about whether it was feasible. In an April 13, 2023 update, he substantially qualified that hope: parameterized prompts appeared extremely difficult, possibly impossible, to implement on the then-current architecture of language models. The article also recorded attacks against JSON quoting and an AI-based injection detector.[6]

His June 16, 2025 lethal trifecta describes a dangerous combination: access to private data, exposure to untrusted content, and the ability to communicate externally. In his account, malicious instructions in a document or tool result can redirect an agent toward retrieving private information and sending it out. The outbound channel can be an HTTP request, image load or rendered link, as well as a messaging tool.[7]

Willison warns that users mixing tools from different sources—including through Model Context Protocol—can assemble this combination themselves. He is skeptical that probabilistic guardrails provide dependable protection, emphasizing that model behavior is nondeterministic. He points developers toward designs that constrain consequential actions after untrusted input, while advising end users who cannot enforce those boundaries to avoid the three-capability combination entirely.[7]

Willison’s enthusiasm for local models includes concrete demonstrations of their errors. In “Let’s be bear or bunny”, published May 1, 2023, he described running an MLC language model on his iPhone. An ego search mixed recognizable biographical details with an invented problem-solving pattern attributed to him. He asked the model to explain it and playfully adopted the phrase. In that month’s No Moat conversation, he argued that local assistants could be useful by searching and operating tools, rather than relying on up-to-date facts embedded in the model.[11][16]

His pelicans-on-bicycles comparison asks models to “Generate an SVG of a pelican riding a bicycle”—an image expressed in code that readers can inspect as a drawing. On October 25, 2024, he reported trying 16 models through LLM, including successive versions of Claude 3.5 Sonnet. He chose the scene because he likes pelicans and suspected that matching SVGs were absent from training data. That rationale was conjecture; the exercise is an informal comparison, rather than a validated measure of general model capability.[12]

On February 23, 2026, Willison announced Agentic Engineering Patterns, a guide to professional software development with coding agents. His defining feature is that agents can generate and execute code, allowing them to test and iterate with less turn-by-turn human guidance. He distinguishes this practice from vibe coding in its original sense of paying no attention to the generated code. His first chapters addressed the falling cost of producing code and red/green test-driven development.[13]

Willison states that the guide’s prose is his own, with LLM assistance for proofreading, example code and supporting tasks. He also reported that almost all of its Django publishing infrastructure was written by Claude Opus 4.6 running in Claude Code for web, accessed from his iPhone. This separates his public writing policy from his extensive use of agents to implement software.[13]

Before this AI work, Willison helped build a newspaper web framework, co-founded a conference startup and held engineering leadership roles at Eventbrite. Those earlier projects provide context for his work on reusable tools, database choices and software delivery.[1][2][10][17]

At World Online, a newspaper web operation in Lawrence, Kansas, Adrian Holovaty and Willison switched from PHP to Python in fall 2003. They extracted a reusable framework while building interactive websites on journalism deadlines, refining it over two years. World Online open-sourced the resulting Django framework in summer 2005. Its reusable components grew from applications already running in production.[2]

Willison and Natalie Downe co-founded the social conference directory Lanyrd in 2010. Downe’s account credits her with the initial idea and recalls building the prototype while food poisoning interrupted their honeymoon travels in Casablanca. They shared a working version with friends after a week. She contrasts that decision with their earlier wildlifenearyou project, developed privately for 14 months without user feedback, and recalls launch attention overwhelming Lanyrd’s infrastructure.[10][1]

Downe credits Willison, Tom and Andrew with much of Lanyrd’s investment in one-click deployment; even nontechnical hires deployed a change on their first day. The founders joined Y Combinator in 2011, and Eventbrite acquired Lanyrd in 2013. The acquisition brought Willison into Eventbrite, where a June 2014 interview identified him as Director of Architecture; his biography also records an engineering-director role.[10][17][1]

In that 2014 interview, Willison distinguished scaling traffic from scaling codebase complexity and engineering teams. He explained Lanyrd’s move from MySQL to PostgreSQL through the practical difficulty of adding columns to its growing tables. He also advocated feature flags: teams could merge and deploy unfinished features behind switches, expose them to selected users, and turn them off without a major rollback. These were explanations of the systems and constraints he worked with at the time.[17]

Willison has blogged about programming and web development since 2002 and began publishing weeknotes in 2019. In a September 2024 Software Misadventures interview, he said, “My blog has been an accountability mechanism for me for a while now.” Reporting progress sometimes encourages him to invest in an open-source project so he has concrete work to describe. He also treats explanation as a way to structure his thinking, adding comparisons and context even to short link posts.[1][18][9]

His biography and disclosures describe independent work on open-source data-journalism tools, consulting and training, and one day a week working for Prime Radiant, Jesse Vincent’s applied AI research lab. He also discloses Python Software Foundation board membership; the foundation’s 2025–2026 roster lists him as a director.[1][14]ⁿ²