Simon Willison is a software developer, blogger, and open-source contributor who publishes detailed annual year-in-review posts tracking the progress of large language models from a practitioner perspective. He is the co-creator of the Django web framework and the creator of Datasette. His writing appears at simonwillison.net.
Willison was born in January 1981 in the United Kingdom and holds a B.Sc. in Computer Science from the University of Bath (2005) (Source: https://en.wikipedia.org/wiki/Simon_Willison). He has been blogging about web development and programming since 2002 (Source: https://simonwillison.net/about/).
Background
Willison began professional web development in 2000 as a webmaster and developer at the UK website Gameplay before leaving in 2001 to attend the University of Bath; while studying he worked part-time at Incutio, where he wrote the Incutio XML-RPC Library for PHP, later used in WordPress and Drupal (Source: https://en.wikipedia.org/wiki/Simon_Willison). During 2003–2004, on an industrial placement at the Lawrence Journal-World, he and fellow developers Adrian Holovaty, Jacob Kaplan-Moss, and Wilson Miner created Django, an open-source web application framework for Python (Source: https://en.wikipedia.org/wiki/Simon_Willison).
After graduating in 2005, Willison worked on Yahoo's Technology Development team, including early versions of the Fire Eagle geolocation service, and in 2008 was hired by The Guardian as a software architect (Source: https://en.wikipedia.org/wiki/Simon_Willison). In late 2010 he co-founded the social conference directory Lanyrd with Natalie Downe; the company received Y Combinator funding in early 2011 and was acquired by Eventbrite in 2013, after which Willison joined Eventbrite's engineering team in San Francisco and became an engineering director (Source: https://en.wikipedia.org/wiki/Simon_Willison) (Source: https://simonwillison.net/about/). He later created Datasette, an open-source tool for exploring and publishing data built around SQLite, and describes himself as working full-time on open-source tools for data journalism (Source: https://simonwillison.net/about/).
Roles and affiliations
Willison has served on the board of directors of the Python Software Foundation since 2022 (Source: https://en.wikipedia.org/wiki/Simon_Willison) (Source: https://simonwillison.net/about/). He is a GitHub Star, an unpaid recognition position, and participated in GitHub's Accelerator program in 2023 and Mozilla's MIECO (Internet Ecosystem) program in 2023–2024 (Source: https://simonwillison.net/about/).
On his blog Willison discloses that he does not receive compensation for writing about specific topics and has not accepted payments from LLM vendors, while noting that he is frequently invited to preview new products and features from organizations including OpenAI, Anthropic, Google's Gemini team, and Mistral, often under NDA or embargo and sometimes with free API credits; he states one exception, that OpenAI paid for his time attending a GPT-5 preview used in a video, without editorial control over what he wrote (Source: https://simonwillison.net/about/). As of February 2026 he accepts weekly text-banner sponsorship on his blog and newsletter, stating that sponsors have no influence over editorial content (Source: https://simonwillison.net/about/).
Coined terms and observations
Willison coined the term "prompt injection" in September 2022 to describe a class of attacks in which trusted and untrusted content are mixed in the same LLM context; he named it after SQL injection and distinguishes it from jailbreaking, which he treats as a separate issue (Source: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). His framing built on an attack first demonstrated by Riley Goodside, with Willison providing the nomenclature that was subsequently adopted (Source: https://en.wikipedia.org/wiki/Simon_Willison). He was also an early proponent of the term "slop" for low-quality AI-generated content, though he has said the term predates him (Source: https://en.wikipedia.org/wiki/Simon_Willison).
In June 2025 Willison introduced the term "lethal trifecta" for AI agents that combine three capabilities: access to private data, exposure to untrusted content, and the ability to communicate externally. He argues that any system combining all three is exposed to data-exfiltration attacks, that LLMs cannot reliably distinguish the provenance of instructions because all input is concatenated into one token sequence, and that vendor "guardrail" products advertising high but imperfect capture rates are insufficient because a 95% rate is a failing grade in web-application security (Source: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). The Economist cited the concept in a September 2025 article on AI security (Source: https://en.wikipedia.org/wiki/Simon_Willison).
In April 2023 Willison released a command-line tool, llm, for running prompts against remote LLM APIs or locally installed models from the terminal (Source: https://en.wikipedia.org/wiki/Simon_Willison). In October 2024 he introduced an informal benchmark that asks models to generate an SVG image of "a pelican riding a bicycle," which he has used in coverage of subsequent model releases (Source: https://en.wikipedia.org/wiki/Simon_Willison).
Positions and observations
Willison's year-in-review posts document the spread of LLM access over time, tracing a progression from GPT-4 exclusivity to availability across 18 or more organizations, to models running on laptops, to Chinese open-weight models. He frames this as a democratization of LLMs (Simon Willison's Year-in-Review LLM Posts (2023–2025)).
He distinguishes benchmark performance from real-world utility, describing a gap between what models score on evaluations and what they prove useful for in practice. His posts also raise practitioner-level concerns, including prompt injection, "slop," uneven distribution of knowledge about how to use the tools, and what he describes as a normalization of deviance.
Willison's account of how quickly competitors caught up with frontier models — faster than expected — bears on the Fast-Follow Problem.
Sources
- Simon Willison's Year-in-Review LLM Posts (2023–2025)
- About Simon Willison — https://simonwillison.net/about/
- Simon Willison — Wikipedia — https://en.wikipedia.org/wiki/Simon_Willison
- The lethal trifecta for AI agents (June 2025) — https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/