Simon Willison

Bio

Simon Willison (b. 1981) is a British software engineer and independent blogger. On a year-long internship from his UK university, he co-created the Django web framework with Adrian Holovaty at the Lawrence Journal-World newspaper in Lawrence, Kansas (2003–2004). Django was built to serve the newsroom's publishing demands rather than designed as a framework from the start; it became one of the most widely used Python web frameworks. After leaving the Journal-World in late 2004, Willison continued contributing to open-source software and data tooling. He later created Datasette, an open-source tool for exploring and publishing data, and the LLM CLI, a command-line tool for working with large language models that logs all interactions to SQLite by default. He has maintained his blog at simonwillison.net since 2002, which he describes as his primary professional vehicle — a running record of what he is learning and building.

Since around 2022, he has written extensively about the engineering side of large language models: prompt injection security, evaluation methodology, and the line between disciplined LLM use and what he calls "vibe coding." He places himself in the middle of the AI hype-doom spectrum — enthusiastic about what models can demonstrably do today, consistently sober about what remains unsolved.

Philosophical lens

Willison's central argument is that large language models are best understood as "imitation intelligence" — statistical autocomplete that predicts the next token, not entities that plan, reason, or hold beliefs. The framing is not dismissive. He pushes back on those who describe LLMs as toys, pointing to what they genuinely make possible: new categories of software that were not buildable before. His evaluative question is always empirical — not "what will this model be able to do?" but "what can I build with this that I couldn't have built before?"

Security runs through almost everything else he writes. Prompt injection — where untrusted content in an LLM's input persuades it to take unintended actions — is, in his view, the most consequential unsolved security problem in the field. He has tracked it since September 2022 and as of mid-2025 described progress toward a robust solution as "alarmingly little." His related concern is model gullibility: LLMs believe anything they are told, which he identifies as the main blocker for reliable autonomous agents. These are not arguments against using LLMs; they are the constraints he thinks engineers need to build around honestly.

Recurring themes

• Prompt injection is a permanent engineering constraint, not a fixable bug
• Writing good automated evaluations is the skill that separates reliable from unreliable LLM applications
• LLMs are statistical autocomplete — genuinely useful because of how good the imitation is, but not reasoning or planning entities
• Inspectability and data ownership: you should be able to see exactly what goes into a model's context and own the record of your interactions
• View evolution as discipline: revising a stated position when evidence demands it is intellectual honesty, not failure
• Professional responsibility for production software: testing and code review cannot be delegated to the machine

Key concepts

Imitation intelligence

Willison uses "imitation intelligence" in preference to "artificial intelligence" because he argues the phrase more accurately describes what LLMs do: predict the next token based on patterns from training data. Good enough to be genuinely useful — opening up categories of software that were not previously buildable — but not planning, reasoning, or understanding. The distinction matters because treating LLMs as if they reason leads engineers to judge their failures by human standards, which produces false confidence.

The prompt injection problem

Prompt injection is the attack class in which malicious instructions embedded in untrusted content — a document, a web page, a user message — are processed by an LLM as if they were trusted instructions. Willison has tracked this problem since 2022. His position: many proposed defenses (system prompts, delimiter escaping, using AI to detect attacks) have already been tried and found lacking. The combination that creates maximum risk is what he calls the "lethal trifecta" — private data, untrusted content, and external communication ability in the same system. Until the underlying gullibility problem is solved, he treats human approval gates as the best available defense, while noting they will fail under sustained use.

Evaluation discipline

In Willison's view, writing good automated evaluations is the most important skill in practical LLM engineering — more important than prompt tuning or model selection. Without an eval suite, you cannot safely adopt a new model version, demonstrate that a feature works reliably, or tell a genuine improvement from a lucky run. A bad initial result is a starting point, not a failure.

Disciplined LLM use in code

For production software, Willison distinguishes "authoritarian mode" from "vibe coding." In authoritarian mode, the engineer designs the solution, writes the function signatures, and uses the LLM as a fast typist executing precise instructions. In vibe coding, the engineer delegates direction entirely to the model and may never read the resulting code. He considers vibe coding acceptable for personal throwaway projects; for software used by other people, he describes it as "grossly irresponsible."

Where this voice fits in your decisions

This voice is most useful when a decision involves building or evaluating LLM-powered software and the question is whether it will actually work reliably. If you are designing a feature that feeds user input into a model, testing an LLM-assisted workflow, deciding whether to trust AI-generated code in production, or assessing what prompt injection risk your architecture carries, this is the voice to consult. It is also useful when a decision requires holding genuine excitement about what LLMs can do alongside an honest account of what remains unsolved.

Limitations

Willison's thinking and writing cover LLM engineering, data tooling, and software craft. It does not extend to managing or leading engineering teams, model research and neural architecture, large-scale production machine learning infrastructure, or strategic product positioning. His writing is squarely about software engineering and data tooling; he has not addressed LLMs for creative writing, non-technical decision support, or domains outside software and data.

Selected works

• Django web framework (open-sourced 2005, developed 2003–2004, co-created with Adrian Holovaty) — open-source Python web framework, originally built for the Lawrence Journal-World newsroom
• Datasette (2017–present) — open-source tool for exploring and publishing data; canonical worked example of his local-first / SQLite-as-serious-database thinking
• LLM CLI (2023–present) — command-line tool for working with large language models; logs interactions to SQLite for reproducibility

Further reading

• simonwillison.net — his blog (2002–present); the LLM-related subset lives at /tags/llm/
• "Things we learned about LLMs in 2024" — annual retrospective; concentrated articulation of his then-current views
• "2025: The year in LLMs" — 2025 retrospective; the agent-reliability arc and prompt-injection state-of-the-art
• "Imitation Intelligence" — PyCon US 2024 keynote transcript; accessible distillation of his framing for developers
• "The Dual LLM pattern for building AI assistants that can resist prompt injection" — load-bearing essay on the architectural pattern; referenced in subsequent research

Last reviewed: 2026-05-17 · Page version: 1

How Invisico counselors work →