Simon Willison

Simon Willison is the creator of Datasette, a co-creator of the Django web framework, and an independent open-source developer whose work spans data journalism, SQLite, and practical AI engineering. He builds tools that make powerful systems more accessible and inspectable while exposing the security risks of giving language models access to sensitive information.

From Django to independent open source

Willison began blogging about web development in 2002. At the Lawrence Journal-World, he worked with Adrian Holovaty on the newsroom software that became Django. He subsequently worked at Yahoo and The Guardian, where his projects included interactive reporting, crowdsourced analysis of British parliamentary expenses, and making newsroom data available for public scrutiny.

In 2010, he co-founded Lanyrd with Natalie Downe. The Y Combinator-backed conference directory was acquired by Eventbrite in 2013, and Willison became an engineering director there. He left in late 2019 for a John S. Knight Journalism Fellowship at Stanford, concentrating on open-source tools for data journalism and beginning his career as an independent developer. His account of Django’s origins and his subsequent career connects these experiences directly.

Datasette and the tooling ecosystem

Datasette, his flagship project, turns SQLite databases into searchable, publishable interfaces. Its surrounding ecosystem includes sqlite-utils for creating and transforming databases, shot-scraper for browser automation, and files-to-prompt for preparing source files as model input. His weblog documents experiments, releases, model evaluations, and security investigations.

Language models, security & accountability

• Composable language-model infrastructure. His LLM command-line project connects hosted and local models to Unix pipelines, plugins, embeddings, tool calls, and SQLite-backed conversation logs. He has combined Hacker News data, jq, and Claude to summarize discussions, and used embeddings with a locally running model to search his own writing.

• Prompt injection and the lethal trifecta. Willison introduced the term prompt injection for attacks on applications that combine trusted instructions with untrusted input. His lethal trifecta identifies the especially dangerous combination of private-data access, exposure to malicious content, and an external communication channel. He advocates permission boundaries, sandboxing, and safeguards against techniques such as data theft through rendered Markdown images.

• The pelican-on-a-bicycle benchmark. Asking text models to generate SVG code depicting a pelican riding a bicycle gives Willison a memorable, imperfect test of coding, visual reasoning, and instruction-following. He expanded it into automated screenshot comparisons and Elo-style rankings while questioning conventional benchmarks. His enthusiasm for a strong result from a laptop-sized model reflects his commitment to local inference on personally controlled hardware.

• Accountability for AI-assisted work. Willison distinguishes useful assistance from unrequested, unreviewed AI-generated content: people remain responsible for checking and standing behind what they publish. His work on sqlite-utils with a coding agent applies that standard to maintained software. In a conversation with Anthropic engineers, he examined code ownership, evaluation, permission controls, and whether increasingly capable agents can expand engineering ambition without sacrificing human judgment.