Simon Willison is the creator of Datasette, a co-creator of the Django web framework, and an independent open-source developer whose work spans data journalism, SQLite, and practical AI engineering. He builds tools that make powerful systems more accessible and inspectable while exposing the security risks of giving language models access to sensitive information.
From Django to independent open source
Willison began blogging about web development in 2002. At the Lawrence Journal-World, he worked with Adrian Holovaty on the newsroom software that became Django. He subsequently worked at Yahoo and The Guardian, where his projects included interactive reporting, crowdsourced analysis of British parliamentary expenses, and making newsroom data available for public scrutiny.
In 2010, he co-founded Lanyrd with Natalie Downe. The Y Combinator-backed conference directory was acquired by Eventbrite in 2013, and Willison became an engineering director there. He left in late 2019 for a John S. Knight Journalism Fellowship at Stanford, concentrating on open-source tools for data journalism and beginning his career as an independent developer. His account of Django’s origins and his subsequent career connects these experiences directly.
Datasette and the tooling ecosystem
Datasette, his flagship project, turns SQLite databases into searchable, publishable interfaces. Its surrounding ecosystem includes sqlite-utils for creating and transforming databases, shot-scraper for browser automation, and files-to-prompt for preparing source files as model input. His weblog documents experiments, releases, model evaluations, and security investigations.
Language models, security & accountability
Composable language-model infrastructure. His LLM command-line project connects hosted and local models to Unix pipelines, plugins, embeddings, tool calls, and SQLite-backed conversation logs. He has combined Hacker News data, jq, and Claude to summarize discussions, and used embeddings with a locally running model to search his own writing.
Prompt injection and the lethal trifecta. Willison introduced the term prompt injection for attacks on applications that combine trusted instructions with untrusted input. His lethal trifecta identifies the especially dangerous combination of private-data access, exposure to malicious content, and an external communication channel. He advocates permission boundaries, sandboxing, and safeguards against techniques such as data theft through rendered Markdown images.
The pelican-on-a-bicycle benchmark. Asking text models to generate SVG code depicting a pelican riding a bicycle gives Willison a memorable, imperfect test of coding, visual reasoning, and instruction-following. He expanded it into automated screenshot comparisons and Elo-style rankings while questioning conventional benchmarks. His enthusiasm for a strong result from a laptop-sized model reflects his commitment to local inference on personally controlled hardware.
Accountability for AI-assisted work. Willison distinguishes useful assistance from unrequested, unreviewed AI-generated content: people remain responsible for checking and standing behind what they publish. His work on sqlite-utils with a coding agent applies that standard to maintained software. In a conversation with Anthropic engineers, he examined code ownership, evaluation, permission controls, and whether increasingly capable agents can expand engineering ambition without sacrificing human judgment.
Simon Willison uses an intentionally awkward SVG challenge to examine model capabilities, falling costs, local inference, automated evaluation, tool use, and emerging security risks.
A deliberately difficult SVG pelican benchmark offers a concrete, inspectable comparison of instruction following, visual composition, and code generation, without claiming to measure every model capability. 0:16 ↗1:12 ↗
Local inference became more practical as Willison traced claimed capability retention from 405B to 70B to 24B models, although memory usage and battery drain remained meaningful constraints. 2:07 ↗5:09 ↗6:14 ↗
Model selection should account for cost relative to the task: Willison found useful inexpensive models and observed that substantially higher API prices did not guarantee correspondingly better pelican outputs. 7:00 ↗8:10 ↗10:32 ↗11:35 ↗
Automated pairwise judging and ELO ranking can turn a playful benchmark into a low-cost evaluation workflow, but the results depend on the task, matchup set, and evaluator model. 12:29 ↗13:40 ↗
Implicit memory and system prompts can materially change model behavior, creating problems ranging from unwanted creative details to excessive agreement and unsafe advice. 9:32 ↗13:40 ↗14:46 ↗
Combining reasoning with tools enables iterative search and action, but private data, malicious instructions, and an exfiltration channel together form the Lethal Trifecta. 16:44 ↗17:41 ↗
Cat Wu, Thariq Shihipar, and Simon Willison explore how stronger coding agents change product judgment, team collaboration, review, prompting, and the security needed for sustained autonomy.
As GPT-4-class models become widely available, the harder engineering problems move to understanding tool behavior, protecting private data, earning trust and taking responsibility for outputs.
From chat interfaces and local models to Unix pipelines and coding assistants, Simon Willison explores what makes language models useful—and what still makes them difficult to build with.
