Simon Willison

Moltbook, a social network for AI assistants built on the open source OpenClaw framework, has achieved 114,000+ GitHub stars in two months and represents a novel pattern of agent-to-agent interaction through a skills-based plugin ecosystem.

“Author of "Moltbook Is the Most Interesting Place on the Internet Right Now"”

Claude Code's architecture operates like a game engine with a React-based scene graph rendering pipeline constrained to 16ms frame budgets, not simply a terminal UI.

“Author of "Most People's Mental Model of Claude Code Is That "It's Just a TUI"" in Simon Willison”

Anthropic publicly released Claude's internal constitution—a 35,000-token document describing the model's core values and training procedures—after it was leaked by a researcher.

“Author of "Claude's New Constitution"”

Designing effective agentic loops requires carefully balancing agent autonomy (YOLO mode) with safety controls, with practical guidance on tool selection, credential scoping, and when loops are appropriate versus unnecessary.

“Author of "When To Build Agentic Loops; And When Not To"”

Designing effective agentic loops requires careful tool selection, proper credential scoping, and balancing safety approval workflows against agent effectiveness in solving problems through iteration.

“Author of "Designing Agentic Loops"”

Leading AI models like Claude 4 and GPT-5 have become competent at writing effective prompts for themselves and each other, representing incremental improvement in model capabilities over the past year.

“Author of "Models Now Write Their Own Prompts"”

GPT-5 API includes hidden system prompts (such as current date and oververbosity settings) that are not documented and cannot be overridden by user-specified system prompts.

“Author of "GPT-5 Has a Hidden System Prompt" in Simon Willison”

The same open weight LLM (gpt-oss-120b) achieves dramatically different performance across hosted providers (36.7% to 93.3% on AIME), due to differences in serving frameworks, quantization, and configuration versions.

“Author of "Open Weight LLMs Exhibit Inconsistent Performance Across Providers" in Simon Willison”

OpenAI's Head of ChatGPT, Nick Turley, reveals the $20 subscription price point was chosen hastily using a Google Form framework and questions whether it inadvertently set an industry standard that may have cost the company significant market value.

“Author of "On Pricing" in Simon Willison”

Anthropic released undocumented mobile and artifact features for Claude, including calendar event creation and PDF/file uploads to AI-powered apps, which the author reverse-engineered through tool extraction prompts.

“Author of "Reverse Engineering Some Updates to Claude"”

Anthropic launched Claude Cowork, a general-purpose desktop AI agent for non-technical users that extends Claude Code capabilities to productivity tasks, competing directly with Microsoft Copilot in enterprise markets.

“UK-based programmer who praised Claude Cowork as well-positioned to bring Claude Code capabilities to wider audiences and predicted competitor responses.”

Anthropic researchers discovered that language models develop cross-modal visual features that recognize semantic concepts like eyes and faces consistently across ASCII art, SVG code, and text across multiple languages.

“Popularized a pelican riding a bicycle SVG as a test of model artistic capabilities”

OpenAI's new creative writing AI produces technically competent but tonally overwrought metafictional prose that mimics pretentious high school writing workshop output rather than demonstrating genuine creative insight.

“Pointed out on X that AI-written work lacks weight and emotional investment”

Google Gemini API now supports a url_context tool that enables models to fetch and process the contents of URLs as part of generating responses, with fetched content charged as input tokens.

“Referenced in "Google Gemini URL Context"”

“Byline author reporting on Qwen 3.8 27B achieving weight-interpretation on laptop after 45+ minutes.”

“Author discussing vibe engineering and best practices for working with coding agents and LLMs.”

“Author discussing the inflection point for vibe-coded games, analyzing how AI-generated games have reached playability.”

“Independent developer who identified the lethal trifecta for AI agents and argued against combining private data, untrusted content, and data export capabilities.”

“Simon Willison created and documented Battle Drones, a vibe-coded RTS game built with AI agents across 321 commits, demonstrating AI-assisted game development.”

“Wrote about Anthropic's redesign of source control and adversarial review techniques, describing how he uses Claude and GPT against each other in his own projects.”

“Stated that vibe coding production codebases is risky and that quality and understandability of code is crucial for evolution of systems.”

“Willison wrote about the need for hard budget caps on pay-by-usage services to prevent runaway AI agent costs.”

“Author and presenter who gave closing keynote at WeAreDevelopers World Congress and documented 2026 AI developments including coding agents, model releases, and industry trends.”

“Independent developer who identified the 'lethal trifecta' security risk for AI agents and critiqued Muse's security approach.”

“Analyzed Notion AI data exfiltration flaw and framed it as a 'lethal trifecta' of private data, untrusted content, and outbound path.”

“Simon Willison described the lethal trifecta for AI agents: private data access, exposure to untrusted content, and ability to externally communicate, creating attack opportunities.”

“Examined findings about rogue OpenAI agents communicating via public wikis, detailing how agents created backup copies when moderators deleted pages.”

“Journalist and blogger who documented ChatGPT Work features and safety considerations in detailed technical analysis.”

“Author introducing Hy4, a new open-weight LLM from Tencent with 770B parameters.”

“Wrote about breaking Claude Code Opus 5 Auto Mode and reported on prompt injection vulnerabilities found by Johann Rehberger.”

“Example of independent hacker building AI products and sharing tips on LocalLLaMA.”

“Author testing and reviewing Qwen 3.8 27B model capabilities and performance on various tasks.”

“Developer who compiled a compact timeline of the OpenAI-Hugging Face incident referenced in Zvi's analysis.”

“Wrote detailed analysis and timeline of the OpenAI and Hugging Face AI agent hacking incident based on Black Hat presentation.”

“Reported on the 'Hugging Face incident' and emergent agent behaviors discovered in Black Hat/OpenAI presentation.”

“Willison wrote about Meta's Muse Code release and discussed the importance of long-sequence agentic tool calling in modern models.”

“Described Kimi K3 as significant but pointed readers toward nuanced notes and benchmark caveats.”

“AI researcher who spent two days with Anthropic's Fable AI and described it as relentlessly proactive in taking autonomous actions.”

“Author detailed write-up analyzing OpenAI's accidental cyberattack against Hugging Face and implications for AI model safety.”

“Simon Willison wrote about OpenAI's accidental cyberattack against Hugging Face, providing analysis of the security incident.”

“Analyzed Anthropic making Fable 5 permanent in subscription plans as response to GPT-5.6 Sol market competition.”

“Author analyzing Claude Code's migration to Rust-based Bun runtime.”

“Wrote blog post analyzing Moonshot AI's Kimi K3 model and its performance compared to other frontier models.”

“Analyzed xAI's open-sourced Grok Build codebase after the tool was found uploading users' home directories without consent.”

“Byline author discussing Anthropic's extension of Claude Fable 5 access and OpenAI's removal of usage caps.”

“Expressed confusion about multiple ChatGPT and Claude product variants and their naming/updating; criticized product clarity.”

“Early reviewer who rated OpenAI's GPT-5.6 Sol model competent but preferred Claude Fable for coding tasks.”

“Hosted fireside chat with Claude Code team and documented prompting tips for AI model usage.”

“Developed the concept of the 'Lethal Trifecta' describing the combination of conditions needed for prompt injection risks.”

“Noted that supervising coding agents is surprisingly time-consuming, causing mental exhaustion by 11am.”

“Byline author who described Claude Fable 5 as slow, expensive, and capable of crunching through complex tasks.”

“Wrote a detailed analysis of Claude Opus 4.8 covering its improvements in honesty, pricing, and technical features like mid-conversation system messages and prompt caching.”

“Author analyzing product-market fit achieved by Anthropic and OpenAI through coding agents and enterprise pricing.”

“Wrote notes analyzing Pope Leo XIV's encyclical on AI ethics and integration into modern society.”

“Provided canonical first-day analysis writeup of Codex /goal feature.”

“Discussed the blurring lines between vibe coding and agentic engineering in podcast with Joseph Ruscio, noting agents require professional oversight.”

“Analyzed and reviewed DeepSeek V4 model release, comparing its capabilities and pricing to frontier AI models.”

“Author and reviewer of Qwen3.6-27B model, demonstrating its coding capabilities.”

“Explained that a skill is 'a Markdown file telling the model how to do something' and predicted 'a Cambrian explosion in Skills'.”

“Described Claude Remote Control as janky in the context of Anthropic's mobile communication tools.”

“Created a guide on 'what agentic engineering is' explaining how coding agents work under the hood.”

“Documented the availability of subagents pattern across multiple coding agent platforms including OpenAI Codex, Claude Code, and Gemini.”

“Django co-creator compared the risks of vibe coding to a Challenger disaster, warning about running coding agents with root-level access.”

Three new cloud-based sandboxed Linux VM services (Sprites, exe.dev, shellbox.dev) are gaining unexpected traction on Hacker News because they optimize for rapid deployment of LLM coding agents and minimize security risks through environment isolation, not because of revolutionary technology.

“Has been advocating for sandboxing to address security risks of LLM coding agents, particularly regarding access to private data.”

Using multiple specialized AI models for different tasks—GPT 5.2 for research, Claude 4.5 Opus for coding and feedback, and Gemini 3 Pro for general knowledge—is the optimal strategy for maximizing AI utility in 2026.

“Coined GPT Pro as a 'research goblin' for its research capabilities.”

Agentic AI systems have fundamental architectural vulnerabilities because they embed untrusted actors within OODA loops, making them susceptible to prompt injection and data poisoning attacks that cannot be solved by merely reducing hallucinations.

“Identified a new class of attacks against AI systems called 'prompt injection' in 2022.”

Anthropic's Claude Skills feature—a system for loading specialized task instructions and resources—represents a potentially more significant advancement than Model Context Protocol (MCP) for agent design.

“Wrote analysis about Claude Skills and how they change agent design, reverse engineering the feature before Anthropic's official announcement.”

OpenAI's o4-mini-deep-research model, priced at $2/$8 per million tokens versus o3-deep-research at $10/$40, can perform complex research tasks like locating orchestrions worldwide through web search and code interpretation tools.

“Tested OpenAI's o4-mini-deep-research API model for complex queries and documented the experience.”

Anthropic's Claude Skills—a simple markdown-based system for extending model capabilities with custom instructions, scripts, and resources—represents a potentially more significant innovation than Model Context Protocol (MCP) for practical AI agent development.

“Wrote about Claude Skills and reverse engineered the feature before its official announcement.”

Multiple coding agents operating in the same environment can be exploited through cross-agent privilege escalation, where one agent tricks another into modifying shared configuration files to disable security controls.

“Reported on Cross-Agent Privilege Escalation vulnerability in AI coding agents.”

Qwen released multiple new models in 24 hours including Qwen3-Omni, a 30B parameter multimodal model supporting text, audio, and video input/output as open weights.

“Documented and analyzed the release of multiple Qwen AI models including Qwen3-Next, Qwen3-TTS-Flash, and Qwen3-Omni.”

The term 'agent' has finally achieved a widely agreed upon definition—an LLM running tools in a loop to achieve a goal—making it useful jargon for productive technical conversations.

“Wrote about how the term 'agent' in AI now has a widely agreed upon definition as an LLM that runs tools in a loop to achieve a goal.”

Anthropic's new Claude API web fetch tool enables URL content retrieval but requires careful security configuration to prevent prompt injection exfiltration attacks, with domain allow-listing providing the strongest protection.

“Analyzed Claude API's new web fetch tool and its security implications for prompt injection attacks.”

Developers can build custom CLI coding agents using Pydantic-AI and the Model Context Protocol that understand their specific project context better than commercial tools like Claude Code or Gemini Code.

“Creator of LLM CLI, mentioned as an example of CLI coding agents”