Simon Willison
In plain wordsA British programmer and blogger, co-creator of the Django web framework, whose widely read writing on language models coined 'prompt injection' and the 'lethal trifecta'.
British software developer and writer whose blog has become one of the most cited running commentaries on large language modelslarge language model, n.: A computer program trained on enormous amounts of text to predict the words that come next. At vast scale, that simple skill lets it chat, answer questions, translate, summarize and write code.. Co-creator of the Django web framework (2005) and creator of the open-source data tool Datasette and the LLM command-line utility, he coined prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger. in September 2022, by analogy with SQL injection, and the lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over. (June 2025): an agent that combines access to private data, exposure to untrusted content and the ability to communicate externally can be tricked into leaking the data. He popularized AI slopAI slop, n.: Low-quality content churned out in bulk by AI — bland articles, fake-looking images, filler videos — posted to grab clicks or fill space, with little care for accuracy or value. (2024) as a name for unwanted AI-generated content, devised the informal pelican on a bicyclepelican on a bicycle, n.: A joke test in which an AI model is asked to draw, by writing code, a pelican riding a bicycle; comparing the results became a popular, lighthearted way to judge each new model. benchmark (2024), and proposed vibe engineeringvibe engineering, n.: Building serious software with AI coding assistants while still taking full responsibility for its quality — the careful, professional opposite of vibe coding. (2025) for disciplined professional work with coding agentscoding agent, n.: An AI agent that writes and fixes software by itself: it reads a codebase, edits files, runs commands and tests, and keeps working until a feature is built or a bug is fixed., in contrast to vibe codingvibe coding, n.: Programming by conversation: you ask an AI for what you want, try out what it produces and ask again until it works, trusting the code without really reading it.. His habit of documenting hands-on experiments with each major model release made the blog a reference for practitioners and journalists.
Related
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- lethal trifectalethal trifecta, n.: A rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over.
- AI slopAI slop, n.: Low-quality content churned out in bulk by AI — bland articles, fake-looking images, filler videos — posted to grab clicks or fill space, with little care for accuracy or value.
- pelican on a bicyclepelican on a bicycle, n.: A joke test in which an AI model is asked to draw, by writing code, a pelican riding a bicycle; comparing the results became a popular, lighthearted way to judge each new model.
- vibe engineeringvibe engineering, n.: Building serious software with AI coding assistants while still taking full responsibility for its quality — the careful, professional opposite of vibe coding.
- indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it.
Sources
- Willison, S. (2022). Prompt injection attacks against GPT-3. simonwillison.net, 12 September 2022.
- Willison, S. (2025). The lethal trifecta for AI agents: private data, untrusted content, and external communication. simonwillison.net, 16 June 2025.