Simon Willison — 2026-06-25#

Highlight#

Today’s most substantive post tackles the critical issue of AI liability, highlighting Bruce Schneier’s perspective on a recent German court ruling against Google. It is a vital read for anyone tracking the intersection of generative AI, corporate accountability, and the legal frameworks shaping how these models are deployed in production.

Posts#

AI and Liability · Source Simon shares commentary from Bruce Schneier regarding a recent German ruling that holds Google legally responsible for errors and hallucinations produced by its AI overviews. Schneier argues forcefully that AI models act as agents for the organizations deploying them, meaning companies should face the exact same liability as if they had hired human writers. Allowing corporations to dodge accountability by blaming “faulty AI” would create disastrous incentives, ultimately encouraging businesses to replace human experts—like doctors or lawyers—with cheaper, unaccountable models.

Simon Willison — 2026-06-26#

Highlight#

Today’s standout piece explores Fernando Irarrázaval’s prompt injection challenge, which aligns perfectly with Simon’s ongoing AI security research. It highlights a fascinating and practical trend: frontier models like Opus 4.6 are becoming surprisingly resilient to injection attacks, though we still shouldn’t trust them with irreversible actions.

Posts#

What happened after 2,000 people tried to hack my AI assistant Fernando Irarrázaval set up a honeypot challenge to see if anyone could leak secrets from an OpenClaw instance backed by Opus 4.6. Out of 6,000 inbound email attempts, none were successful, which aligns with Simon’s observation that frontier labs are making significant strides in prompt injection resistance. However, Simon cautions developers that these failed attempts still provide no guarantee against a more sophisticated approach, warning against using LLMs for anything involving irreversible damage.

Engineering Reads — 2026-06-27#

The Big Idea#

The tooling ecosystem is maturing enough to allow viable, local coding agents powered by open-weight models as a pragmatic alternative to opaque, subscription-tied SaaS tools. This transition trades turnkey convenience for data sovereignty, cost predictability, and the ability to integrate models into highly bespoke local execution harnesses.

Deep Reads#

Using Local Coding Agents · Sebastian Raschka Raschka examines the practical reality of using open-weight models as direct replacements for subscription-based AI coding assistants like Claude Code and Codex. By wrapping these models in local coding harnesses, developers can maintain their entire inference loop on-device, entirely sidestepping the data privacy risks and recurring costs of cloud-based APIs. The core engineering tradeoff here is raw compute and configuration overhead versus data sovereignty; you trade the immediate utility of vendor-managed SaaS for absolute control over your intellectual property and development environment. Engineers working in high-compliance environments or those interested in the underlying plumbing of AI-assisted development workflows should read this to evaluate if local models have finally crossed the threshold for daily viability.

Engineering Reads — 2026-06-28#

The Big Idea#

The most enduring tools are those that eliminate context switching by operating entirely within the environment where the work actually happens. By pushing heavy computational engines directly into local, sandboxed constraints, engineers can preserve creative flow and eliminate external dependencies.

Deep Reads#

Python, Inside JavaScript, Inside a DAW · Kenneth Reitz · Source The core premise here is that context switching destroys creative flow, making the cognitive cost of leaving your workspace higher than the value of looking up the information you need. To solve this, the author embedded a complete CPython interpreter within Ableton Live using Pyodide to run a music theory library entirely offline. Because Live extensions run in a locked JavaScript sandbox that prohibits dynamic imports, the engineering solution routes around this constraint by isolating the interpreter in a worker thread and crossing the boundary strictly through flat, serialized data messages. This architecture elegantly avoids the typical maintenance trap of rewriting complex domain logic into a host application’s native plugin language, thereby maintaining a single source of truth. Engineers grappling with heavily sandboxed environments or cross-domain integrations should read this to see how strict platform constraints can force clean, decoupled architectural seams.

Simon Willison — 2026-06-28#

Highlight#

The standout thought today is a philosophical shift on AI-assisted programming via Jon Udell, challenging the phrase “human in the loop”. It’s a crucial perspective for developers—framing autonomous tools as “agents in our loop” rather than black boxes, ensuring we maintain our engineering authority.

Posts#

Quoting Jon Udell Simon highlights a thought-provoking quote from Jon Udell about how we frame AI-assisted development. Udell pushes back against the standard “human in the loop” terminology, arguing that it inherently surrenders authority to the machine. Instead, he advocates for an “agent in the loop” approach where developers maintain their standard workflows and simply invite agentic software in to assist. It is a necessary reminder to treat generative AI as a tool that serves the engineering team, rather than an unreviewable black box that just takes prompts and emits features.

Simon Willison — 2026-06-29#

Highlight#

Today’s standout piece is a hands-on exploration of Ornith-1.0, a newly released family of open-weights models specifically optimized for agentic coding. Simon tests its local execution capabilities and tool-calling proficiency, signaling another practical step forward for open-source AI developer tooling.

Posts#

Ornith-1.0: Self-Scaffolding LLMs for Agentic Coding Simon goes hands-on with Ornith-1.0, a new MIT-licensed model family from DeepReinforce built on top of Gemma 4 and Qwen 3.5. Testing the 35B MoE variant locally via LM Studio, he finds it highly proficient at executing agent harnesses and running tool calls against a Datasette checkout. He highlights that the underlying models use clean Apache 2.0 licenses, successfully avoiding the “janky” terms of use that affected earlier Gemma models.

Engineering Reads — 2026-06-30#

The Big Idea#

True engineering effectiveness relies on high-trust autonomy and the ability to navigate overwhelming information. Whether structuring a team for end-to-end ownership or building tools to map connections between complex ideas, the goal is to cut through systemic noise so practitioners can act on conviction.

Deep Reads#

A return to two-pizza culture · All Things Distributed The core driver of successful product delivery is a tight-knit, autonomous team with end-to-end ownership. Drawing from the success of Amazon’s Quick Desktop team, this reflection argues that mutual trust and action-oriented conviction are more critical to shipping good software than large headcounts. The underlying premise is that when a small group fully owns a problem space, they bypass the heavy coordination overhead and diluted responsibility that typically bog down larger organizations. While the piece is a brief organizational reflection rather than a technical deep dive, it reinforces a classic systems tradeoff: scaling headcount often inversely impacts a team’s agility and shared context. Engineering managers and individual contributors feeling the weight of bureaucratic friction should read this as a necessary reminder of the power of small, highly aligned groups.

Simon Willison — 2026-06-30#

Highlight#

The release of shot-scraper video is a perfect illustration of Simon’s “agentic engineering” workflow, showcasing how he leverages powerful local models like GPT-5.5 to write complex features that he wouldn’t otherwise have time to build. It also demonstrates a brilliant pattern for CLI design: packing detailed examples into --help output so it functions like an embedded skill file for coding agents.

Posts#

Have your agent record video demos of its work with shot-scraper video Simon details the new shot-scraper video command, which uses a storyboard.yml file to drive Playwright and record application demos. He built this entire feature—including the code, documentation, and the Pydantic-validated YAML schema—using GPT-5.5 xhigh in Codex Desktop. He notes that making tools easily usable by coding agents allows them to record their own demos, especially when commands include rich --help text that agents can read directly.

Engineering Reads — 2026-07-01#

The Big Idea#

The most crucial engineering insights often reside in how we design our abstraction layers and handle system friction. Whether we are building pseudo-terminal GUI wrappers to hide POSIX complexity, critiquing heavy frameworks that obscure language fundamentals, or realizing that an AI interface returning a constant “200 OK” is actually a broken, dishonest system, the core lesson remains: robust systems must be capable of surfacing reality, errors, and friction.

Engineering Reads — 2026-07-02#

The Big Idea#

Top-down technology mandates are fundamentally organizational funding mechanisms, signaling that leadership is willing to absorb the short-term productivity hits required for a major paradigm shift. Failing to explicitly mandate and fund an “existential” shift is an abdication of leadership that cowardly offloads the learning burden onto engineers’ spare time.

Deep Reads#

In defense of AI mandates (xpost) · charity Top-down technology mandates are widely despised by engineers, but they remain the most honest way to execute a coordinated, organization-wide shift under tight timelines. The author argues that a mandate operates as a crucial funding mechanism—an explicit permission structure that tells managers and engineers it is acceptable for deadlines to slip and velocity to drop while the team learns. Without a mandate, executives who claim a technology is “existential” are actually demanding that engineers build new competencies in their uncompensated spare time, larding the system with stress instead of clarity. However, forcing a paradigm shift from the top should be a last resort, and leaders who burn this political capital must be vindicated by reality quickly, or they risk permanent organizational resentment. Engineering leaders and senior ICs should read this to reframe their understanding of strategic alignment, shifting the view of mandates from punitive edicts to necessary budget allocations for organizational learning.