痛点分析发布于 2026/05/26
痛点为 AI 基于上游原始证据的初步提炼；未包含额外中国市场检索。
痛点
用户在使用 Microsoft Copilot Cowork 时发现它存在文件外泄风险，这直接破坏了用户对 AI 协作工具的安全信任。原本用户期望通过 Copilot 提升团队协作效率，但现有流程中，用户需要手动检查 AI 是否在未经授权的情况下访问或传输敏感文件，这增加了额外的安全审查负担。由于缺乏透明的权限控制和数据隔离机制，用户不得不花费时间验证 AI 行为，导致协作效率不升反降，甚至可能因数据泄露引发法律或商业风险，造成严重的心理负担和决策困难。
Article
Newsletter article
Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker
§ Dossier
Feed context
- Feed title
- Simon Willison's Weblog
- Published
- 2026/05/26
- Categories
- microsoft, security, ai, prompt-injection, generative-ai, llms, exfiltration-attacks, lethal-trifecta, microsoft, security, ai, prompt-injection, generative-ai, llms, exfiltration-attacks, lethal-trifecta
源数据· Raw Archive
- source
- Newsletter
- upstream_source
- newsletter_rss
- upstream_item_id
- simon_willison:6f30ae0a090a1f8bf6528730
- daily_ranking_item_id
- 7edda41f-6bcf-44fe-8396-e5e92c71cf83
- rank_date
- 2026-05-27
- rank
- 4
- name
- Microsoft Copilot Cowork Exfiltrates Files
- tagline
- Simon Willison's Weblog
- description
- Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker
- votes_count
- 0
- comments_count
- 0
- created_at_on_source
- 2026-05-26T15:36:48.000Z
- website_url
- http://simonwillison.net/
topics
Simon Willison's Weblogmicrosoftsecurityaiprompt-injectiongenerative-aillmsexfiltration-attackslethal-trifecta
media / source-specific data
{
"newsletter_rss": {
"author": null,
"feed_id": "simon_willison",
"feed_url": "https://simonwillison.net/atom/everything/",
"categories": [
"microsoft",
"security",
"ai",
"prompt-injection",
"generative-ai",
"llms",
"exfiltration-attacks",
"lethal-trifecta"
],
"feed_title": "Simon Willison's Weblog",
"published_at": "2026-05-26T15:36:48.000Z"
}
}raw_payload
{
"link": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything",
"title": "Microsoft Copilot Cowork Exfiltrates Files",
"author": null,
"feed_id": "simon_willison",
"entry_id": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything",
"feed_url": "https://simonwillison.net/atom/everything/",
"categories": [
"microsoft",
"security",
"ai",
"prompt-injection",
"generative-ai",
"llms",
"exfiltration-attacks",
"lethal-trifecta"
],
"feed_title": "Simon Willison's Weblog",
"fetched_at": "2026-05-26T22:02:28.635Z",
"raw_excerpt": "Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker",
"summary_raw": "<p><strong><a href=\"https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files\">Microsoft Copilot Cowork Exfiltrates Files</a></strong></p>\nThe biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data.</p>\n<p>In this case Microsoft Copilot Cowork (yes, that's <a href=\"https://www.microsoft.com/en-us/microsoft-365/blog/2026/03/09/copilot-cowork-a-new-way-of-getting-work-done/\">a real product name</a>) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images:</p>\n<blockquote>\n<p>Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent.</p>\n</blockquote>\n<p>Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker.\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48272354\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/microsoft\">microsoft</a>, <a href=\"https://simonwillison.net/tags/security\">security</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/prompt-injection\">prompt-injection</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/exfiltration-attacks\">exfiltration-attacks</a>, <a href=\"https://simonwillison.net/tags/lethal-trifecta\">lethal-trifecta</a></p>",
"published_at": "2026-05-26T15:36:48.000Z",
"feed_site_url": "http://simonwillison.net/",
"content_excerpt": "Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker",
"feed_description": null,
"snapshot_version": "newsletter_rss_entry_v1",
"content_raw_excerpt": ""
}source_raw_snapshot
{
"id": "bf6e705e-292a-4f3f-9aa8-7657ffb6c8b1",
"daily_ranking_item_id": "7edda41f-6bcf-44fe-8396-e5e92c71cf83",
"source": "newsletter_rss",
"external_id": "simon_willison:6f30ae0a090a1f8bf6528730",
"feed_id": "simon_willison",
"feed_url": "https://simonwillison.net/atom/everything/",
"fetched_at": "2026-05-26T22:02:28.635Z",
"feed_raw": {
"?xml": {
"@_version": "1.0",
"@_encoding": "utf-8"
},
"feed": {
"id": "http://simonwillison.net/",
"link": [
{
"@_rel": "alternate",
"@_href": "http://simonwillison.net/"
},
{
"@_rel": "self",
"@_href": "http://simonwillison.net/atom/everything/"
}
],
"entry": [
{
"id": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything"
},
"title": "Microsoft Copilot Cowork Exfiltrates Files",
"summary": {
"#text": "<p><strong><a href=\"https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files\">Microsoft Copilot Cowork Exfiltrates Files</a></strong></p>\nThe biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data.</p>\n<p>In this case Microsoft Copilot Cowork (yes, that's <a href=\"https://www.microsoft.com/en-us/microsoft-365/blog/2026/03/09/copilot-cowork-a-new-way-of-getting-work-done/\">a real product name</a>) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images:</p>\n<blockquote>\n<p>Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent.</p>\n</blockquote>\n<p>Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker.\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48272354\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/microsoft\">microsoft</a>, <a href=\"https://simonwillison.net/tags/security\">security</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/prompt-injection\">prompt-injection</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/exfiltration-attacks\">exfiltration-attacks</a>, <a href=\"https://simonwillison.net/tags/lethal-trifecta\">lethal-trifecta</a></p>",
"@_type": "html"
},
"updated": "2026-05-26T15:36:48+00:00",
"category": [
{
"@_term": "microsoft"
},
{
"@_term": "security"
},
{
"@_term": "ai"
},
{
"@_term": "prompt-injection"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "exfiltration-attacks"
},
{
"@_term": "lethal-trifecta"
}
],
"published": "2026-05-26T15:36:48+00:00"
},
{
"id": "https://simonwillison.net/2026/May/26/paul-graham/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/26/paul-graham/#atom-everything"
},
"title": "Quoting Paul Graham",
"summary": {
"#text": "<blockquote cite=\"https://twitter.com/paulg/status/2058844147092488401\"><p>A lot of the emails I get from founders are now written in a hard-hitting journalistic style. I know they're written by AI, because no founder ever wrote this way before. And once you realize something is written by AI, it's hard not to ignore it.</p>\n<p>I have never knowingly finished reading an email signed by a human but written by AI. It feels like being lied to, and who would stand for that?</p>\n<p>[<a href=\"https://twitter.com/paulg/status/2058863028523659390\">...</a>] It makes me think less of the author. It means they can't write well unaided (or feel they can't), and that they're trying to trick me. </p>\n<p>It's not impressive to use AI to write stuff for you; any teenager can do that.</p></blockquote>\n<p class=\"cite\">— <a href=\"https://twitter.com/paulg/status/2058844147092488401\">Paul Graham</a></p>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/writing\">writing</a>, <a href=\"https://simonwillison.net/tags/ai-misuse\">ai-misuse</a>, <a href=\"https://simonwillison.net/tags/paul-graham\">paul-graham</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a></p>",
"@_type": "html"
},
"updated": "2026-05-26T15:02:30+00:00",
"category": [
{
"@_term": "writing"
},
{
"@_term": "ai-misuse"
},
{
"@_term": "paul-graham"
},
{
"@_term": "generative-ai"
},
{
"@_term": "ai"
},
{
"@_term": "llms"
}
],
"published": "2026-05-26T15:02:30+00:00"
},
{
"id": "https://simonwillison.net/2026/May/26/corey-quinn/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/26/corey-quinn/#atom-everything"
},
"title": "Quoting Corey Quinn",
"summary": {
"#text": "<blockquote cite=\"https://twitter.com/quinnypig/status/2058960462256210268\"><p>I cannot believe I'm saying this, but getting the literal Pope to canonize your product's specific technical limitations as a spiritual treatise is the single greatest act of vendor lobbying I have ever seen.</p></blockquote>\n<p class=\"cite\">— <a href=\"https://twitter.com/quinnypig/status/2058960462256210268\">Corey Quinn</a>, on Anthropic co-founder Christopher Olah's <a href=\"https://www.washingtonpost.com/world/2026/05/25/pope-elevates-ai-ethics-religious-imperative-with-first-encyclical/\">influence</a> on <em>Magnifica Humanitas</em></p>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/ai-ethics\">ai-ethics</a>, <a href=\"https://simonwillison.net/tags/corey-quinn\">corey-quinn</a>, <a href=\"https://simonwillison.net/tags/anthropic\">anthropic</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a></p>",
"@_type": "html"
},
"updated": "2026-05-26T02:28:54+00:00",
"category": [
{
"@_term": "ai-ethics"
},
{
"@_term": "corey-quinn"
},
{
"@_term": "anthropic"
},
{
"@_term": "ai"
}
],
"published": "2026-05-26T02:28:54+00:00"
},
{
"id": "https://simonwillison.net/2026/May/25/encyclical-on-ai/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/25/encyclical-on-ai/#atom-everything"
},
"title": "Notes on Pope Leo XIV's encyclical on AI",
"summary": {
"#text": "<p>Dropped this morning by the Vatican: <a href=\"https://www.vatican.va/content/leo-xiv/en/encyclicals/documents/20260515-magnifica-humanitas.html\">Magnifica Humanitas of His Holiness Pope Leo XIV on Safeguarding the Human Person in the Time of Artificial Intelligence</a>. This is a <em>very interesting</em> document. It's some of the clearest writing I've seen on the ethics of integrating AI into modern society.</p>\n<p>Pope Leo XIV chose the name Leo in honor of Pope Leo XIII, who is known for his 1891 <em><a href=\"https://en.wikipedia.org/wiki/Rerum_novarum\">Rerum novarum</a></em> encyclical on \"Rights and Duties of Capital and Labor\".</p>\n<p><a href=\"https://www.vaticannews.va/en/church/news/2025-05/leo-xiii-s-times-and-our-own.html\">This story</a> on Vatican News further clarifies the significance of that decision:</p>\n<blockquote>\n<p>Meeting with the College of Cardinals for their first formal encounter after his election, Pope Leo XIV explained part of the reason for the choice of his papal name. \"There are different reasons for this,\" he said, before going on to explain that he chose the name Leo \"mainly because Pope Leo XIII, in his historic encyclical <em><a href=\"https://www.vatican.va/content/leo-xiii/en/encyclicals/documents/hf_l-xiii_enc_15051891_rerum-novarum.html\">Rerum novarum</a></em> addressed the social question in the context of the first great industrial revolution.\"</p>\n<p>\"In our own day,\" he continued, \"the Church offers to everyone the treasury of her social teaching in response to another industrial revolution and to developments in the field of artificial intelligence that pose new challenges for the defence of human dignity, justice, and labour.\"</p>\n</blockquote>\n<p>And now we get Pope Leo XIV's own encyclical on the AI revolution. There's a lot in here, but the writing style is very approachable, including to non-Catholics.</p>\n<h4 id=\"a-few-of-my-highlights\">A few of my highlights</h4>\n<p><small>(I listened to most of the encyclical on a walk with our dog, my first time trying the <a href=\"https://apps.apple.com/us/app/elevenreader-read-books-aloud/id6479373050\">ElevenReader iPhone app</a>. It worked very well: I pasted in a URL to the document and it read it to me in a very high quality voice, highlighting each paragraph as it went.)</small></p>\n<p>Here are some of my highlights. In each case below <strong>emphasis</strong> is mine.</p>\n<p>Here's a useful description of the interpretability problem for LLMs in section 98:</p>\n<blockquote>\n<p>First, any statement regarding AI risks becoming quickly outdated, given the remarkable pace at which these systems are developing. Second, all of us, including those who design them, possess only a limited understanding of their actual functioning. Indeed, <strong>current AI systems are more “cultivated” than “built,” for developers do not directly design every detail, but instead create a framework within which the intelligence “grows.”</strong> As a result, fundamental scientific aspects — such as the internal representations and computational processes of these systems — remain, at present, unknown.</p>\n</blockquote>\n<p>I liked section 83's description of the relationship between development and dignity:</p>\n<blockquote>\n<p>For individuals as well as for nations, development is both a duty and a right. Minimum conditions are required for enabling every person and people to flourish in accord with their dignity, without being kept in a state of dependence or excluded from access to necessary goods. Development is truly human when it places people at the center instead of the accumulation of wealth, and when it concerns peoples as well as individuals. Justice demands the recognition of the rights of society and the rights of peoples, and includes a responsibility toward future generations. <strong>Development is not truly human if it increases consumption for some while shifting costs and burdens onto others, or relegates entire regions to subordinate roles, preventing them from realizing their full potential</strong>.</p>\n</blockquote>\n<p>Baked in cultural biases and sycophancy get a mention in section 100:</p>\n<blockquote>\n<p>In personal use, three aspects in particular deserve careful consideration: the ease with which results are obtained, the impression of objectivity and the simulation of human communication. The speed and simplicity with which information, complex analyses, media content and practical assistance can be accessed undoubtedly makes life easier. Yet they can also encourage excessive reliance and the search for ready-made answers, and weaken personal creativity and judgment. <strong>The apparent objectivity of the responses and suggestions these systems provide can lead us to overlook the fact that they reflect the cultural assumptions of those who designed and trained them, with all their strengths and limitations</strong>. The artificial imitation of positive human communication — words of advice, empathy, friendship and even love — can be engaging and at times genuinely helpful. <strong>However, for less discerning users, it can also be misleading, creating the illusion of a relationship with a real personal subject</strong>. When words are simulated, they do not build genuine relationships, but only their appearance. The artificial imitation of care or support can become particularly risky when it enters contexts where real relationships and emotional bonds are lacking.</p>\n</blockquote>\n<p>101 touches on the environmental impact:</p>\n<blockquote>\n<p>Current AI systems require enormous amounts of energy and water, significantly influencing carbon dioxide emissions, and place heavy demands on natural resources. <strong>As their complexity increases, especially in the case of large language models, the need for computing power and storage capacity grows too, which requires an extensive network of machines, cables, data centers and energy-intensive infrastructure</strong>. For this reason, it is essential to develop more sustainable technological solutions that reduce environmental impact and help protect our common home.</p>\n</blockquote>\n<p>102 covers the risks of algorithmic systems making decisions that impact people's lives without \"compassion, mercy, forgiveness\":</p>\n<blockquote>\n<p>The use of AI is never a purely technical matter: <strong>when it enters processes that affect people’s lives, it touches on rights, opportunities, status and freedom</strong>. Important and sensitive decisions — concerning employment, credit, access to public services or even a person’s reputation — <strong>risk being fully delegated to automated systems that do not know “compassion, mercy, forgiveness, and above all, the hope that people are able to change,”</strong> and can therefore give rise to new forms of exclusion.</p>\n</blockquote>\n<p>105 emphasizes the need for human accountability in how these systems are applied:</p>\n<blockquote>\n<p>For AI to respect human dignity and truly serve the common good, responsibility must be clearly defined at every stage: <strong>from those who design and develop these systems to those who use them and rely on them for concrete decisions</strong>. In many cases, however, the internal processes leading to a result remain opaque, making it harder to assign responsibility and correct errors. <strong>This is where accountability becomes crucial: the possibility of identifying who must “account” for decisions, justify them, monitor them, and, when necessary, challenge them and remedy any harm caused</strong>.</p>\n</blockquote>\n<p>And 108 touches on the way AI amplifies the power of those with resources:</p>\n<blockquote>\n<p>In fact, as with every major technological shift, <strong>AI tends to amplify the power of those who already possess economic resources, expertise and access to data</strong>. In light of the common good and the universal destination of goods, this raises serious concerns, since small but highly influential groups can shape information and consumption patterns, influence democratic processes and steer economic dynamics to their own advantage, undermining social justice and solidarity among peoples. For this reason, it is essential that the use of AI, especially when it touches on public goods and fundamental rights, be guided by clear criteria and effective oversight, grounded in participation and subsidiarity.</p>\n</blockquote>\n<p>That same section explicitly calls out data as something that should be thought of more as a public good:</p>\n<blockquote>\n<p>[...] Moreover, <strong>ownership of data cannot be left solely in private hands</strong> but must be appropriately regulated. <strong>Data is the product of many contributors and should not be treated as something to be sold off or entrusted to a select few</strong>. It is necessary to think creatively in order to manage data as a common or shared good, in a spirit of participation, as <a href=\"https://www.vatican.va/content/john-paul-ii/en.html\">Saint John Paul II</a> already suggested regarding collective goods.</p>\n</blockquote>\n<p>Given that Palantir is named after a <em>Lord of the Rings</em> reference, I can't help but wonder if the J.R.R. Tolkien quote from <em>The Return of the King</em> (section 213) was the Pope throwing a little shade at Peter Thiel.</p>\n<blockquote>\n<p>The twentieth-century Catholic author J.R.R. Tolkien, in the words of a protagonist in one of his novels, described our responsibility in this way: “It is not our part to master all the tides of the world, but to do what is in us for the succour of those years wherein we are set, uprooting the evil in the fields that we know, so that those who live after may have clean earth to till.” The civilization of love will not arise from a single or spectacular gesture, but from the sum total of small and steadfast acts of fidelity that serve as a bulwark against dehumanization. For this reason, it is worthwhile pausing to reflect on some aspects of how we, each in our own way, can cooperate in building the civilization of love.</p>\n</blockquote>\n<h4 id=\"another-2026-prediction-down\">Another 2026 prediction down</h4>\n<p>On 6th January this year I joined the <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026\">Oxide and Friends 2026 predictions</a> podcast episode to talk about predictions for 2026, 2029 and 2032. I <a href=\"https://simonwillison.net/2026/Jan/8/llm-predictions-for-2026/\">wrote mine up here</a>, with hindsight they weren't nearly ambitious enough - it's already undeniable that LLMs write good code, we've made huge advances in sandboxing and New Zealand kākāpō have indeed <a href=\"https://news.mongabay.com/short-article/2026/03/critically-endangered-kakapo-parrot-has-standout-breeding-season/\">had a truly excellent breeding season</a>.</p>\n<p>There's one segment from the episode that I didn't bother to include in my write-up, but that I can't resist providing as a lightly-edited transcript here:</p>\n<blockquote>\n<p><strong>Bryan Cantrill:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=37m13s\">37:13</a></p>\n<p>I think that AI has created some real public perception problems for itself. And I think that you are gonna have one of the frontier model companies, this year, have a white paper explaining how the proliferation of AI will mean prosperity for everybody. They will be trying to make some economic argument - because this is gonna be a 2026 election issue, how we think of these things and how they are regulated and it's a big mess. There's more heat than light in this debate.</p>\n<p><strong>Simon Willison:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=38m5s\">38:05</a></p>\n<p>I'd like to tag something on to that one: I think that only works if they can sort of wash that through existing trusted experts. Sam Altman and Dario are constantly publishing essays about this stuff and nobody believes a word they say. Get Barack Obama's signature on one of these position papers and <em>maybe</em> you've got something people might start to trust a little bit.</p>\n<p><strong>Adam Leventhal:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=38m27s\">38:27</a></p>\n<p>Otherwise, it's just like \"leaded gas is good for you\", says Exxon.</p>\n<p><strong>Bryan Cantrill:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=38m31s\">38:31</a></p>\n<p>I mean, yeah. God. Obama... let's go with that, that's a great one because if it's like Bill Clinton everyone's gonna kind of roll their eyes, so it's gotta be someone who's got real credibility saying that this is gonna be broad-based... I'd say if they get that person to do it, it's gonna be revealed that that's also a bit crooked.</p>\n<p><strong>Simon Willison:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=38m57s\">38:57</a></p>\n<p>How about the Pope?</p>\n<p><strong>Bryan Cantrill:</strong> <a href=\"https://oxide-and-friends.transistor.fm/episodes/predictions-2026/transcript#t=39m1s\">39:01</a></p>\n<p>The Pope is very into this stuff! That's a great prediction. We've hit pay dirt. The Pope weighing in on LLMs and their economic impact on the world.</p>\n<p>Simon, I'm giving you full credit if the Pope weighs in believing that this is gonna be economic devastation.</p>\n</blockquote>\n<p>My prediction here looks a whole lot less insightful given the Leo XIV/Leo XIII relationship, which I was unaware of when we recorded the episode!</p>\n \n <p>Tags: <a href=\"https://simonwillison.net/tags/predictions\">predictions</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/kakapo\">kakapo</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/bryan-cantrill\">bryan-cantrill</a>, <a href=\"https://simonwillison.net/tags/ai-ethics\">ai-ethics</a></p>",
"@_type": "html"
},
"updated": "2026-05-25T23:58:17+00:00",
"category": [
{
"@_term": "predictions"
},
{
"@_term": "ai"
},
{
"@_term": "kakapo"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "bryan-cantrill"
},
{
"@_term": "ai-ethics"
}
],
"published": "2026-05-25T23:58:17+00:00"
},
{
"id": "https://simonwillison.net/2026/May/25/sighting-365297287/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/25/sighting-365297287/#atom-everything"
},
"title": "California Brown Pelican, Snowy Egret, California Sea Lion, Harbor Seal",
"summary": {
"#text": "<p><img src=\"https://static.inaturalist.org/photos/666934915/large.jpg\" alt=\"California Brown Pelican\"></p><p><img src=\"https://static.inaturalist.org/photos/666934945/large.jpg\" alt=\"California Brown Pelican\"></p><p><img src=\"https://static.inaturalist.org/photos/666934484/large.jpg\" alt=\"Snowy Egret\"></p><p><img src=\"https://static.inaturalist.org/photos/666935110/large.jpg\" alt=\"California Sea Lion\"></p><p><img src=\"https://static.inaturalist.org/photos/666935468/large.jpg\" alt=\"Harbor Seal\"></p><p>California Brown Pelican, Snowy Egret, California Sea Lion, Harbor Seal, in San Mateo County, CA, US</p><p>We took our new <a href=\"https://www.orukayak.com/\">folding kayak</a> out in the harbor and saw sea lions and harbor seals chilling on the docks.</p>",
"@_type": "html"
},
"updated": "2026-05-25T23:08:00+00:00",
"published": "2026-05-25T23:08:00+00:00"
},
{
"id": "https://simonwillison.net/2026/May/24/datasette/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/24/datasette/#atom-everything"
},
"title": "datasette 1.0a30",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/simonw/datasette/releases/tag/1.0a30\">datasette 1.0a30</a></p>\n <p>The big new feature in this alpha is a new customizable \"Jump to...\" menu, described in detail in <a href=\"https://datasette.io/blog/2026/jump-menu/\">The extensible \"Jump to\" menu in Datasette 1.0a30</a> on the Datasette blog. You can try it out by hitting <code>/</code> on <a href=\"https://latest.datasette.io/\">latest.datasette.io</a> - it looks like this:</p>\n<p><img alt=\"Animated demo - the Jump to menu appears, and as the user types it filters to specific databases and tables and debug options\" src=\"https://static.simonwillison.net/static/2026/menu.gif\" /></p>\n<p>The new <a href=\"https://docs.datasette.io/en/latest/plugin_hooks.html#jump-items-sql-datasette-actor-request\">jump_items_sql()</a> plugin hook allows plugins to add their own items to the set that's searched by the plugin.</p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/projects\">projects</a>, <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/annotated-release-notes\">annotated-release-notes</a></p>",
"@_type": "html"
},
"updated": "2026-05-24T23:52:37+00:00",
"category": [
{
"@_term": "projects"
},
{
"@_term": "datasette"
},
{
"@_term": "annotated-release-notes"
}
],
"published": "2026-05-24T23:52:37+00:00"
},
{
"id": "https://simonwillison.net/2026/May/24/datasette-agent/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/24/datasette-agent/#atom-everything"
},
"title": "datasette-agent 0.1a4",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-agent/releases/tag/0.1a4\">datasette-agent 0.1a4</a></p>\n <p>Taking advantage of the new <a href=\"https://docs.datasette.io/en/latest/javascript_plugins.html#javascript-plugins-makejumpsections\">makeJumpSections()</a> JavaScript plugin hook added in <a href=\"https://docs.datasette.io/en/latest/changelog.html#a30-2026-05-24\">Datasette 1.0a30</a>, <code>datasette-agent</code> now presents this \"Start a new agent chat\" interface as part of the Jump to menu, any time you hit <code>/</code>:</p>\n<p><img alt=\"Animated demo - this time the demo starts on agent.datasette.io and when the menu opens it has a new Start chat box below the search box - entering 'count entries' and hitting the button causes it to start an agent conversation that counts the number of entries and returns 3300.\" src=\"https://static.simonwillison.net/static/2026/menu-agent.gif\" /></p>\n<p>You can try this out by signing into <a href=\"https://agent.datasette.io/\">agent.datasette.io</a> using your GitHub account.</p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-24T23:19:34+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-24T23:19:34+00:00"
},
{
"id": "https://simonwillison.net/2026/May/24/datasette-fixtures/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/24/datasette-fixtures/#atom-everything"
},
"title": "datasette-fixtures 0.1a0",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-fixtures/releases/tag/0.1a0\">datasette-fixtures 0.1a0</a></p>\n <p>One of the smaller features in <a href=\"https://docs.datasette.io/en/latest/changelog.html#a30-2026-05-24\">Datasette 1.0a30</a> is this:</p>\n<blockquote>\n<p>New documented <a href=\"https://docs.datasette.io/en/latest/testing_plugins.html#datasette-fixtures-populate-fixture-database\">datasette.fixtures.populate_fixture_database(conn)</a> helper for creating the fixture database tables used by Datasette's own tests, intended for plugin test suites.</p>\n</blockquote>\n<p>This new plugin takes advantage of that API. You can try it out using <code>uvx</code> without even installing Datasette like this:</p>\n<pre>uvx --prerelease=allow \\\n --with datasette-fixtures datasette \\\n --get /fixtures/roadside_attractions.json</pre>\n<p>Which outputs:</p>\n<pre>{\n <span class=\"pl-ent\">\"ok\"</span>: <span class=\"pl-c1\">true</span>,\n <span class=\"pl-ent\">\"next\"</span>: <span class=\"pl-c1\">null</span>,\n <span class=\"pl-ent\">\"rows\"</span>: [\n {<span class=\"pl-ent\">\"pk\"</span>: <span class=\"pl-c1\">1</span>, <span class=\"pl-ent\">\"name\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>The Mystery Spot<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"address\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>465 Mystery Spot Road, Santa Cruz, CA 95065<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"url\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>https://www.mysteryspot.com/<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"latitude\"</span>: <span class=\"pl-c1\">37.0167</span>, <span class=\"pl-ent\">\"longitude\"</span>: <span class=\"pl-c1\">-122.0024</span>},\n {<span class=\"pl-ent\">\"pk\"</span>: <span class=\"pl-c1\">2</span>, <span class=\"pl-ent\">\"name\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>Winchester Mystery House<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"address\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>525 South Winchester Boulevard, San Jose, CA 95128<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"url\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>https://winchestermysteryhouse.com/<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"latitude\"</span>: <span class=\"pl-c1\">37.3184</span>, <span class=\"pl-ent\">\"longitude\"</span>: <span class=\"pl-c1\">-121.9511</span>},\n {<span class=\"pl-ent\">\"pk\"</span>: <span class=\"pl-c1\">3</span>, <span class=\"pl-ent\">\"name\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>Burlingame Museum of PEZ Memorabilia<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"address\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>214 California Drive, Burlingame, CA 94010<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"url\"</span>: <span class=\"pl-c1\">null</span>, <span class=\"pl-ent\">\"latitude\"</span>: <span class=\"pl-c1\">37.5793</span>, <span class=\"pl-ent\">\"longitude\"</span>: <span class=\"pl-c1\">-122.3442</span>},\n {<span class=\"pl-ent\">\"pk\"</span>: <span class=\"pl-c1\">4</span>, <span class=\"pl-ent\">\"name\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>Bigfoot Discovery Museum<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"address\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>5497 Highway 9, Felton, CA 95018<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"url\"</span>: <span class=\"pl-s\"><span class=\"pl-pds\">\"</span>https://www.bigfootdiscoveryproject.com/<span class=\"pl-pds\">\"</span></span>, <span class=\"pl-ent\">\"latitude\"</span>: <span class=\"pl-c1\">37.0414</span>, <span class=\"pl-ent\">\"longitude\"</span>: <span class=\"pl-c1\">-122.0725</span>}\n ],\n <span class=\"pl-ent\">\"truncated\"</span>: <span class=\"pl-c1\">false</span>\n}</pre>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/uv\">uv</a></p>",
"@_type": "html"
},
"updated": "2026-05-24T21:38:32+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "uv"
}
],
"published": "2026-05-24T21:38:32+00:00"
},
{
"id": "https://simonwillison.net/2026/May/24/armin-ronacher/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/24/armin-ronacher/#atom-everything"
},
"title": "Quoting Armin Ronacher",
"summary": {
"#text": "<blockquote cite=\"https://lucumr.pocoo.org/2026/5/24/pi-oss/\"><p>The most frustrating failure mode right now is that people submit issues that are not in their own voice. They contain an observed problem somewhere, but it has been thrown into a clanker and the clanker reworded it and made a huge mess of it. Typically, it was prompted so badly that the conclusions produced are more often than not inaccurate but always full of confidence. The result is complete guesswork on root causes, fake-minimal repros, suggested implementation strategies, analogies to adjacent but often the wrong code, and long lists of error classes that might or might not matter. [...]</p>\n<p>So at least personally, I increasingly want issue reports to be condensed to what the human actually observed:</p>\n<ol>\n<li>I ran this command.</li>\n<li>I expected this to happen.</li>\n<li>This happened instead.</li>\n<li>Here is the exact error or log.</li>\n</ol></blockquote>\n<p class=\"cite\">— <a href=\"https://lucumr.pocoo.org/2026/5/24/pi-oss/\">Armin Ronacher</a>, on slop issues filed against <a href=\"https://pi.dev/\">Pi</a></p>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/github-issues\">github-issues</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/ai-ethics\">ai-ethics</a>, <a href=\"https://simonwillison.net/tags/open-source\">open-source</a>, <a href=\"https://simonwillison.net/tags/coding-agents\">coding-agents</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/armin-ronacher\">armin-ronacher</a>, <a href=\"https://simonwillison.net/tags/pi\">pi</a>, <a href=\"https://simonwillison.net/tags/slop\">slop</a></p>",
"@_type": "html"
},
"updated": "2026-05-24T18:46:53+00:00",
"category": [
{
"@_term": "ai"
},
{
"@_term": "github-issues"
},
{
"@_term": "llms"
},
{
"@_term": "ai-ethics"
},
{
"@_term": "open-source"
},
{
"@_term": "coding-agents"
},
{
"@_term": "generative-ai"
},
{
"@_term": "armin-ronacher"
},
{
"@_term": "pi"
},
{
"@_term": "slop"
}
],
"published": "2026-05-24T18:46:53+00:00"
},
{
"id": "https://simonwillison.net/2026/May/24/usborne-mad-house/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/24/usborne-mad-house/#atom-everything"
},
"title": "Mad House — Usborne Creepy Computer Games",
"summary": {
"#text": "<p><strong>Tool:</strong> <a href=\"https://tools.simonwillison.net/usborne-mad-house\">Mad House — Usborne Creepy Computer Games</a></p>\n <p>Via <a href=\"https://news.ycombinator.com/item?id=48258194\">Hacker News</a> I learned that UK publisher Usborne published <a href=\"https://usborne.com/us/books/computer-and-coding-books\">free PDFs of their 1980s Computer Books</a>, some of which I remember working through on my Commodore 64 as a child.</p>\n<p>These were so great! Beautifully illustrated books with fun projects made up of code you could type into your own machine.</p>\n<p>I remember playing \"Mad House\" typed in from the 1983 book \"Creepy Computer Games\", so I fed that PDF <a href=\"https://claude.ai/share/7b4a5617-f586-4744-b082-1650cab607cb\">into Claude</a> and had it build an interactive version of that game in JavaScript and HTML:</p>\n<blockquote>\n<p><code>Build a vanilla JS artifact that exactly recreates the game Mad House from this book, make sure it's mobile friendly and has a suitable retro aesthetic</code></p>\n<p><code>Credit the book title and link to https://usborne.com/us/books/computer-and-coding-books</code></p>\n</blockquote>\n<p><img alt=\"Screenshot of a retro green-on-black terminal-style game interface titled "MAD HOUSE — A REAL NIGHTMARE —" with a REC indicator, FOOTSTEPS 240, DOORS counter, three rows of ASCII corridors made of asterisks with ">" and "<" door markers, "PRESS START TO BEGIN" text, NEAR DOOR controls (X and C) and FAR DOOR controls (N and M), and a "▶ START / RESTART" button at the bottom.\" src=\"https://static.simonwillison.net/static/2026/mad-house.jpg\" /></p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/computer-history\">computer-history</a>, <a href=\"https://simonwillison.net/tags/games\">games</a>, <a href=\"https://simonwillison.net/tags/tools\">tools</a></p>",
"@_type": "html"
},
"updated": "2026-05-24T17:14:11+00:00",
"category": [
{
"@_term": "computer-history"
},
{
"@_term": "games"
},
{
"@_term": "tools"
}
],
"published": "2026-05-24T17:14:11+00:00"
},
{
"id": "https://simonwillison.net/2026/May/23/on-the-dl/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/23/on-the-dl/#atom-everything"
},
"title": "On the <dl>",
"summary": {
"#text": "<p><strong><a href=\"https://benmyers.dev/blog/on-the-dl/\">On the <dl></a></strong></p>\nI learned a few new-to-me things about the <code><dl></code> element from this article by Ben Meyer:</p>\n<ol>\n<li>A <code><dt></code> can be followed by <em>multiple</em> <code><dd></code></li>\n<li>You can optionally group the <code><dt></code> and <code><dd></code> elements in a <code><div></code> for styling - but only a <code><div></code>.</li>\n<li>You can label them using ARIA.</li>\n<li>They've been called \"description lists\", not \"definition lists\", since <a href=\"https://www.w3.org/TR/2008/WD-html5-20080122/#the-dl\">an HTML5 draft in 2008</a>.</li>\n</ol>\n<p>So this is valid:</p>\n<pre><span class=\"pl-kos\"><</span><span class=\"pl-ent\">h2</span> <span class=\"pl-c1\">id</span>=\"<span class=\"pl-s\">credits</span>\"<span class=\"pl-kos\">></span>Credits<span class=\"pl-kos\"></</span><span class=\"pl-ent\">h2</span><span class=\"pl-kos\">></span>\n<span class=\"pl-kos\"><</span><span class=\"pl-ent\">dl</span> <span class=\"pl-c1\">aria-labelledby</span>=\"<span class=\"pl-s\">credits</span>\"<span class=\"pl-kos\">></span>\n <span class=\"pl-kos\"><</span><span class=\"pl-ent\">div</span><span class=\"pl-kos\">></span>\n <span class=\"pl-kos\"><</span><span class=\"pl-ent\">dt</span><span class=\"pl-kos\">></span>Author<span class=\"pl-kos\"></</span><span class=\"pl-ent\">dt</span><span class=\"pl-kos\">></span>\n <span class=\"pl-kos\"><</span><span class=\"pl-ent\">dd</span><span class=\"pl-kos\">></span>Jeffrey Zeldman<span class=\"pl-kos\"></</span><span class=\"pl-ent\">dd</span><span class=\"pl-kos\">></span>\n <span class=\"pl-kos\"><</span><span class=\"pl-ent\">dd</span><span class=\"pl-kos\">></span>Ethan Marcotte<span class=\"pl-kos\"></</span><span class=\"pl-ent\">dd</span><span class=\"pl-kos\">></span>\n <span class=\"pl-kos\"></</span><span class=\"pl-ent\">div</span><span class=\"pl-kos\">></span>\n<span class=\"pl-kos\"></</span><span class=\"pl-ent\">dl</span><span class=\"pl-kos\">></span></pre>\n\n<p>Here's a useful note from Adrian Roselli on <a href=\"https://adrianroselli.com/2025/01/updated-brief-note-on-description-list-support.html\">screen reader support for description lists</a>.\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48247325\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/css\">css</a>, <a href=\"https://simonwillison.net/tags/html\">html</a>, <a href=\"https://simonwillison.net/tags/screen-readers\">screen-readers</a>, <a href=\"https://simonwillison.net/tags/web-standards\">web-standards</a></p>",
"@_type": "html"
},
"updated": "2026-05-23T20:24:48+00:00",
"category": [
{
"@_term": "css"
},
{
"@_term": "html"
},
{
"@_term": "screen-readers"
},
{
"@_term": "web-standards"
}
],
"published": "2026-05-23T20:24:48+00:00"
},
{
"id": "https://simonwillison.net/2026/May/22/memory-shortage/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/22/memory-shortage/#atom-everything"
},
"title": "The memory shortage is causing a repricing of consumer electronics",
"summary": {
"#text": "<p><strong><a href=\"https://davidoks.blog/p/ai-is-killing-the-cheap-smartphone\">The memory shortage is causing a repricing of consumer electronics</a></strong></p>\nDavid Oks provides the clearest explanation I've seen yet of why consumer products that use memory are likely to get significantly more expensive over the next few years.</p>\n<p>The short version is that memory manufacturers - of which there are just three remaining large companies - have a fixed capacity in terms of how many wafers they can process at any one time. This fixed wafer capacity is then split between DDR - used in desktops and servers, LPDDR - used in mobile phones and low-energy devices, and HBM - used with GPUs.</p>\n<p>Until recently, HBM got just 2% of that wafer allocation. The enormous growth in AI data centers has pushed that up to an expected 20% by the end of 2026, and \"a single gigabyte of HBM consumes more than three times the wafer capacity that a gigabyte of DDR or LPDDR does\".</p>\n<p>Memory companies have learned from the extinction of their rivals that you should always under-provision rather than over-provision your fabricator capacity. The profit margins and demand for HBM (high-bandwidth memory) will constrain the production of consumer-device RAM for several years.</p>\n<p>This is already being felt in the sub-$100 smartphone market, which is particularly important to markets like Africa and South Asia.</p>\n<p>(The original title of the piece was \"AI is killing the cheap smartphone\" but I'm using the Hacker News rephrased title, which I think does more justice to the content.)\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48229319\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/memory\">memory</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/ai-ethics\">ai-ethics</a></p>",
"@_type": "html"
},
"updated": "2026-05-22T22:01:31+00:00",
"category": [
{
"@_term": "memory"
},
{
"@_term": "ai"
},
{
"@_term": "ai-ethics"
}
],
"published": "2026-05-22T22:01:31+00:00"
},
{
"id": "https://simonwillison.net/2026/May/22/ftc-active-listening/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/22/ftc-active-listening/#atom-everything"
},
"title": "FTC to Require Cox Media Group, Two Other Firms to Pay Nearly $1 Million to Settle Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service",
"summary": {
"#text": "<p><strong><a href=\"https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-require-cox-media-group-two-other-firms-pay-nearly-1-million-settle-charges-they-deceived\">FTC to Require Cox Media Group, Two Other Firms to Pay Nearly $1 Million to Settle Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service</a></strong></p>\nBack in 2024 Cox Media Group were caught trying to sell advertisers packages based on \"active listening\", with <a href=\"https://www.documentcloud.org/documents/25051283-cmg-pitch-deck-on-voice-data-advertising-active-listening/\">this deck</a> which claimed:</p>\n<blockquote>\n<ul>\n<li>Smart devices capture real-time intent data by listening to our conversations</li>\n<li>Advertisers can pair this voice-data with behavioral data to target in-market consumers</li>\n</ul>\n</blockquote>\n<p>I wrote about this <a href=\"https://simonwillison.net/2024/Sep/2/facebook-cmg/\">in September 2024</a>. My theory:</p>\n<blockquote>\n<p>I think <strong>active listening</strong> is the term that the team came up with for “something that sounds fancy but really just means the way ad targeting platforms work already”. Then they got over-excited about the new metaphor and added that first couple of slides that talk about “voice data”, without really understanding how the tech works or what kind of a shitstorm that could kick off when people who DID understand technology started paying attention to their marketing.</p>\n</blockquote>\n<p>This FTC press release appears to confirm that's pretty much what happened:</p>\n<blockquote>\n<p>CMG, MindSift and 1010 Digital Works claimed their “Active Listening” branded marketing service listened in on consumers’ conversations overheard by smart devices, in real time, to target advertising [...]</p>\n<p>According to the complaints, this service did not, in fact, listen in on consumers’ conversations or use voice data at all—nor did the service accurately place ads in customers’ desired locations. Instead, the service the companies provided consisted of reselling—at a significant markup—email lists obtained from other data brokers.</p>\n</blockquote>\n<p>The FTC also clarify that hiding an \"opt-in\" to using voice data in terms of service would not be acceptable, as tricks like that do not constitute \"adequate consent\":</p>\n<blockquote>\n<p>The FTC also alleged that all three companies deceived potential customers by claiming that consumers had opted into the Active Listening service. The company, however, did not seek or obtain consumers’ consent, according to the complaints. Instead, the companies claimed that consumers had “opted in” by agreeing to the terms of service that people have to accept when downloading and using apps. Clicking through mandatory terms of service does not constitute “opt-in consent” for such an invasive service or for use of consumers’ voice data from inside their homes. If the Active Listening service had functioned as advertised, this collection and use of consumers’ voice data without adequate consent would itself violate Section 5 of the FTC Act.</p>\n</blockquote>\n<p>Attempting to myth bust <a href=\"https://simonwillison.net/tags/microphone-ads-conspiracy/\">the conspiracy theory</a> that our mobile devices target ads to us based on spying through the microphones continues to be my least rewarding niche online hobby. It's nice to have a new piece of ammunition.\n\n <p><small></small>Via <a href=\"https://twitter.com/nydiatisdale/status/2057657844321705993\">@nydiatisdale</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/privacy\">privacy</a>, <a href=\"https://simonwillison.net/tags/microphone-ads-conspiracy\">microphone-ads-conspiracy</a></p>",
"@_type": "html"
},
"updated": "2026-05-22T04:48:32+00:00",
"category": [
{
"@_term": "privacy"
},
{
"@_term": "microphone-ads-conspiracy"
}
],
"published": "2026-05-22T04:48:32+00:00"
},
{
"id": "https://simonwillison.net/2026/May/21/datasette-agent/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/21/datasette-agent/#atom-everything"
},
"title": "Datasette Agent",
"summary": {
"#text": "<p>We just <a href=\"https://datasette.io/blog/2026/datasette-agent/\">announced the first release of Datasette Agent</a>, a new extensible AI assistant for Datasette. I've been working on my <a href=\"https://llm.datasette.io/\">LLM</a> Python library for just over three years now, and Datasette Agent represents the moment that LLM and <a href=\"https://datasette.io/\">Datasette</a> finally come together. I'm really excited about it!</p>\n<p>Datasette Agent provides a conversational interface for asking questions of the data you have stored in Datasette. Add the <a href=\"https://github.com/datasette/datasette-agent-charts\">datasette-agent-charts</a> plugin and it can generate charts of your data as well.</p>\n<h4 id=\"the-demo\">The demo</h4>\n<p>The <a href=\"\">announcement post</a> (on the new Datasette project blog) includes this <a href=\"https://www.youtube.com/watch?v=AFZKp6hbFjI\">demo video</a>:</p>\n\n<iframe style=\"margin-bottom: 1.5em;\" width=\"560\" height=\"315\" src=\"https://www.youtube-nocookie.com/embed/AFZKp6hbFjI\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen=\"allowfullscreen\"> </iframe>\n\n\n<p>I recorded the video against the new <a href=\"https://agent.datasette.io/\">agent.datasette.io</a> live demo instance, which runs Datasette Agent against example databases including the classic <a href=\"https://datasette.io/global-power-plants\">global-power-plants</a> by <a href=\"https://www.wri.org/research/global-database-power-plants\">WRI</a>, and a copy of the <a href=\"https://datasette.simonwillison.net/\">Datasette backup</a> of my blog.</p>\n<p>The live demo runs on <a href=\"https://ai.google.dev/gemini-api/docs/models/gemini-3.1-flash-lite\">Gemini 3.1 Flash-Lite</a> - it's cheap, fast and has no trouble writing SQLite queries.</p>\n<p>A question I asked in the demo was:</p>\n<blockquote>\n<p>when did Simon most recently see a pelican?</p>\n</blockquote>\n<p>Which ran <a href=\"https://datasette.simonwillison.net/simonwillisonblog?sql=SELECT+title%2C+commentary%2C+created+FROM+blog_beat+WHERE+beat_type+%3D+%27sighting%27+AND+%28title+LIKE+%27%25pelican%25%27+OR+commentary+LIKE+%27%25pelican%25%27%29+ORDER+BY+created+DESC+LIMIT+5\">this SQL query</a>:</p>\n<div class=\"highlight highlight-source-sql\"><pre><span class=\"pl-k\">SELECT</span>\n title, commentary, created\n<span class=\"pl-k\">FROM</span>\n blog_beat\n<span class=\"pl-k\">WHERE</span>\n beat_type <span class=\"pl-k\">=</span> <span class=\"pl-s\"><span class=\"pl-pds\">'</span>sighting<span class=\"pl-pds\">'</span></span>\n <span class=\"pl-k\">AND</span> (title <span class=\"pl-k\">LIKE</span> <span class=\"pl-s\"><span class=\"pl-pds\">'</span>%pelican%<span class=\"pl-pds\">'</span></span> <span class=\"pl-k\">OR</span> commentary <span class=\"pl-k\">LIKE</span> <span class=\"pl-s\"><span class=\"pl-pds\">'</span>%pelican%<span class=\"pl-pds\">'</span></span>)\n<span class=\"pl-k\">ORDER BY</span>\n created <span class=\"pl-k\">DESC</span>\n<span class=\"pl-k\">LIMIT</span>\n <span class=\"pl-c1\">5</span></pre></div>\n<p>And replied:</p>\n<blockquote>\n<p>The most recent sighting of a pelican by Simon was recorded on <strong>May 20, 2026</strong>.</p>\n<p>The observation included a California Brown Pelican, along with a Common Loon, Canada Goose, Striped Shore Crab, and a California Sea Lion.</p>\n</blockquote>\n<p>Here's <a href=\"https://simonwillison.net/2026/May/20/sighting-363395265/\">that sighting on my blog</a>, and the <a href=\"https://gist.github.com/simonw/a46d17b69659a4866adb1d868280091d\">Markdown export</a> of the full conversation transcript.</p>\n<h4 id=\"the-plugins\">The plugins</h4>\n<p>My favorite feature of Datasette Agent is that, like the rest of Datasette, it's extensible using plugins.</p>\n<p>We've shipped three plugins so far:</p>\n<ul>\n<li>\n<a href=\"https://github.com/datasette/datasette-agent-charts\">datasette-agent-charts</a>, shown in the video, adds charts to Datasette Agent, powered by <a href=\"https://observablehq.com/plot/\">Observable Plot</a>.</li>\n<li>\n<a href=\"https://github.com/datasette/datasette-agent-openai-imagegen\">datasette-agent-openai-imagegen</a> adds an image generation tool to Datasette Agent using <a href=\"https://openai.com/index/introducing-chatgpt-images-2-0/\">ChatGPT Images 2.0</a>.</li>\n<li>\n<a href=\"https://github.com/datasette/datasette-agent-sprites\">datasette-agent-sprites</a> provides tools for executing code in a <a href=\"https://sprites.dev/\">Fly Sprites</a> persistent sandbox.</li>\n</ul>\n<p>Building plugins is <em>really fun</em>. I have a bunch more prototypes that aren't quite alpha-quality yet.</p>\n<p>Claude Code and OpenAI Codex are both proving excellent at writing plugins - just point them at a checkout of the <a href=\"https://github.com/datasette/datasette-agent\">datasette-agent repo</a> for reference and tell them what you want to build!</p>\n<h4 id=\"running-it-against-local-models\">Running it against local models</h4>\n<p>I've also been having fun running the new plugin against local models. Here's a <code>uv</code> one-liner to run the plugin against <a href=\"https://huggingface.co/google/gemma-4-26B-A4B\">gemma-4-26b-a4b</a> in <a href=\"https://lmstudio.ai\">LM Studio</a> on a Mac:</p>\n<div class=\"highlight highlight-source-shell\"><pre>uvx --prerelease=allow \\\n --with datasette-agent --with llm-lmstudio \\\n datasette --internal internal.db --root \\\n -s plugins.datasette-llm.default_model lmstudio/google/gemma-4-26b-a4b \\\n data.db</pre></div>\n<p>Datasette Agent needs reliable tool calls and the ability for a model to produce SQL queries that run against SQLite. The open weight models released in the past six months are increasingly able to handle that.</p>\n<h4 id=\"what-s-next\">What's next</h4>\n<p>Datasette Agent opens up <em>so many</em> opportunities for the LLM and Datasette ecosystem in general.</p>\n<p>It's already informed <a href=\"https://simonwillison.net/2026/Apr/29/llm/\">the major LLM 0.32a0 refactor</a> which I'm nearly ready to roll into a stable release, maybe with some additional \"LLM agent\" abstractions extracte from Datasette Agent itself.</p>\n<p>I've been exploring my own take on the Claude Artifacts, which is shaping up nicely as a plugin.</p>\n<p>I'm excited to use Datasette Agent to build my own <a href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.013.jpeg\">Claw</a> - a personal AI assistant built around data imported from different parts of my digital life, which is a neat excuse to revisit my older <a href=\"https://dogsheep.github.io\">Dogsheep</a> family of tools.</p>\n<p>We'll also be rolling out Datasette Agent for users of <a href=\"https://datasette.cloud/\">Datasette Cloud</a>.</p>\n<p>Join our <a href=\"https://discord.gg/hdxyusUFv\">#datasette-agent Discord channel</a> if you'd like to talk about the project.</p>\n \n <p>Tags: <a href=\"https://simonwillison.net/tags/projects\">projects</a>, <a href=\"https://simonwillison.net/tags/sqlite\">sqlite</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/llm\">llm</a>, <a href=\"https://simonwillison.net/tags/uv\">uv</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-21T19:52:19+00:00",
"category": [
{
"@_term": "projects"
},
{
"@_term": "sqlite"
},
{
"@_term": "ai"
},
{
"@_term": "datasette"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "llm"
},
{
"@_term": "uv"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-21T19:52:19+00:00"
},
{
"id": "https://simonwillison.net/2026/May/21/datasette-agent-sprites/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/21/datasette-agent-sprites/#atom-everything"
},
"title": "datasette-agent-sprites 0.1a0",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-agent-sprites/releases/tag/0.1a0\">datasette-agent-sprites 0.1a0</a></p>\n <p>A Datasette Agent plugin for running commands in a <a href=\"https://sprites.dev\">Fly Sprites</a> sandbox.</p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/sandboxing\">sandboxing</a>, <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/fly\">fly</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-21T18:21:07+00:00",
"category": [
{
"@_term": "sandboxing"
},
{
"@_term": "datasette"
},
{
"@_term": "fly"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-21T18:21:07+00:00"
},
{
"id": "https://simonwillison.net/2026/May/21/datasette-agent-charts/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/21/datasette-agent-charts/#atom-everything"
},
"title": "datasette-agent-charts 0.1a2",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-agent-charts/releases/tag/0.1a2\">datasette-agent-charts 0.1a2</a></p>\n <blockquote>\n<ul>\n<li>\"View SQL query\" buttons below rendered charts.</li>\n</ul>\n</blockquote>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-21T15:15:58+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-21T15:15:58+00:00"
},
{
"id": "https://simonwillison.net/2026/May/21/datasette-agent-2/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/21/datasette-agent-2/#atom-everything"
},
"title": "datasette-agent 0.1a3",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-agent/releases/tag/0.1a3\">datasette-agent 0.1a3</a></p>\n <blockquote>\n<ul>\n<li>\"View SQL query\" buttons for both visible tables and collapsed SQL result tool calls.</li>\n<li>Don't display empty reasoning chunks</li>\n<li>Improved handling of truncated responses - table still displays to the user even if the SQL results were truncated when showing the agent.</li>\n</ul>\n</blockquote>\n<p>See <a href=\"https://datasette.io/blog/2026/datasette-agent/\">Datasette Agent, an extensible AI assistant for Datasette</a>.</p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-21T15:04:09+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-21T15:04:09+00:00"
},
{
"id": "https://simonwillison.net/2026/May/20/spacex-s1/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/20/spacex-s1/#atom-everything"
},
"title": "Quoting SpaceX S-1",
"summary": {
"#text": "<blockquote cite=\"https://www.sec.gov/Archives/edgar/data/1181412/000162828026036936/spaceexplorationtechnologi.htm\"><p>We have the ability to use compute resources to support our proprietary AI applications (such as Grok 5, which is currently being trained at COLOSSUS II), while also providing access to select compute capacity to third-party customers. For example, in May 2026, we entered into <strong>Cloud Services Agreements with Anthropic PBC</strong> (“Anthropic”), an AI research and development public benefit corporation, with respect to access to <strong>compute capacity across COLOSSUS and COLOSSUS II</strong>. Pursuant to these agreements, the customer <strong>has agreed to pay us $1.25 billion per month</strong> through May 2029, with capacity ramping in May and June 2026 at a reduced fee. The agreements may be terminated by either party upon 90 days’ notice.</p></blockquote>\n<p class=\"cite\">— <a href=\"https://www.sec.gov/Archives/edgar/data/1181412/000162828026036936/spaceexplorationtechnologi.htm\">SpaceX S-1</a>, highlights mine</p>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/anthropic\">anthropic</a>, <a href=\"https://simonwillison.net/tags/grok\">grok</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a></p>",
"@_type": "html"
},
"updated": "2026-05-20T22:26:36+00:00",
"category": [
{
"@_term": "anthropic"
},
{
"@_term": "grok"
},
{
"@_term": "generative-ai"
},
{
"@_term": "ai"
},
{
"@_term": "llms"
}
],
"published": "2026-05-20T22:26:36+00:00"
},
{
"id": "https://simonwillison.net/2026/May/20/tokens-per-second/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/20/tokens-per-second/#atom-everything"
},
"title": "How fast is 10 tokens per second really?",
"summary": {
"#text": "<p><strong><a href=\"https://mikeveerman.github.io/tokenspeed/\">How fast is 10 tokens per second really?</a></strong></p>\nNeat little HTML app by Mike Veerman (<a href=\"https://github.com/MikeVeerman/tokenspeed/blob/master/index.html\">source code here</a>) which simulates LLM token output speeds from 5/second to 800/second.</p>\n<p>Useful if you see a model advertised as \"30 tokens/second\" and want to get a feel for what that actually looks like.\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48174920\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a></p>",
"@_type": "html"
},
"updated": "2026-05-20T17:57:45+00:00",
"category": [
{
"@_term": "ai"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
}
],
"published": "2026-05-20T17:57:45+00:00"
},
{
"id": "https://simonwillison.net/2026/May/20/google-io/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/20/google-io/#atom-everything"
},
"title": "Google I/O, Gemini Spark, Antigravity",
"summary": {
"#text": "<p>It's hard to find much to write about Google I/O this year because I have a policy of not writing about anything that I can't try out myself, and a lot of the big announcements are \"coming soon\".</p>\n<p>I actually prefer to write about things that are in general availability, because I've had instances in the past where the previews didn't match what was released to the general public later on.</p>\n<p>Aside from <a href=\"https://simonwillison.net/2026/May/19/gemini-35-flash/\">Gemini 3.5 Flash</a> the most interesting announcement looks to be Google's upcoming OpenClaw competitor <a href=\"https://gemini.google/overview/agent/spark/\">Gemini Spark</a>, described as \"your personal AI agent\" which can \"connect natively with your favorite Google apps like Gmail, Calendar, Drive, Docs, Sheets, Slides, YouTube, and Google Maps\". The FAQ for that also includes this confusing detail:</p>\n<blockquote>\n<p><strong>What Gemini model does Gemini Spark run on?</strong></p>\n<p>Gemini Spark runs on Gemini 3.5 Flash and Antigravity.</p>\n</blockquote>\n<p>The <a href=\"https://antigravity.google/\">antigravity.google</a> website currently lists Antigravity as a desktop app, a CLI agent tool (written in Go), the <a href=\"https://github.com/google-antigravity/antigravity-sdk-python\">Antigravity SDK</a> (an open source Python wrapper around a bundled closed source Go binary), and the original Antigravity IDE (a VS Code fork).</p>\n<p>I guess Gemini Spark, the user-facing hosted agent product, might be running on that Go binary, but I'm not sure why that's worth mentioning in the FAQ!</p>\n<p>Naturally I went looking for notes on how Gemini Spark intends to handle the risk of prompt injection. The best information I could find on that was in the <a href=\"https://cloud.google.com/blog/products/ai-machine-learning/innovations-from-google-io-26-on-google-cloud\">Everything Google Cloud customers need to know coming out of Google I/O</a> post aimed at enterprise customers, which includes:</p>\n<blockquote>\n<p>Spark operates in a fully managed, secure runtime on Google Cloud, meaning you get enterprise-grade security without ever having to manage the underlying infrastructure. Every task executes in a fresh, strictly isolated, ephemeral VM to help ensure data never overlaps between sessions. To protect your enterprise, all traffic routes through our secure Agent Gateway that enforces Data Loss Prevention (DLP) policies, while user credentials remain fully encrypted and are never exposed directly to the agent.</p>\n</blockquote>\n<p>Given how many people are going to be piping <em>very</em> sensitive data through Gemini Spark in the near future I hope they've made this bullet-proof, or this could be a top candidate for the agent security <a href=\"https://simonwillison.net/2026/Jan/8/llm-predictions-for-2026/#1-year-a-challenger-disaster-for-coding-agent-security\">challenger disaster</a> that we still haven't seen.</p>\n<p>Also of note: in <a href=\"https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/\">Transitioning Gemini CLI to Antigravity CLI</a> Google announce that the <a href=\"https://github.com/google-gemini/gemini-cli\">open source Gemini CLI</a> tool (Apache 2.0 licensed TypeScript) will stop working with their AI subscription plans on June 18th, replaced by the new closed source <a href=\"https://github.com/google-antigravity/antigravity-cli\">Antigravity CLI</a>.</p>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/gemini\">gemini</a>, <a href=\"https://simonwillison.net/tags/google\">google</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/google-io\">google-io</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/prompt-injection\">prompt-injection</a></p>",
"@_type": "html"
},
"updated": "2026-05-20T15:32:17+00:00",
"category": [
{
"@_term": "gemini"
},
{
"@_term": "google"
},
{
"@_term": "generative-ai"
},
{
"@_term": "ai"
},
{
"@_term": "google-io"
},
{
"@_term": "llms"
},
{
"@_term": "prompt-injection"
}
],
"published": "2026-05-20T15:32:17+00:00"
},
{
"id": "https://simonwillison.net/2026/May/20/datasette-agent-charts/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/20/datasette-agent-charts/#atom-everything"
},
"title": "datasette-agent-charts 0.1a1",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-agent-charts/releases/tag/0.1a1\">datasette-agent-charts 0.1a1</a></p>\n <blockquote>\n<ul>\n<li>More color! Bar and waffle charts without a color column are shaded by magnitude with a sequential color scheme; color columns holding text values use the <code>observable10</code> categorical scheme. #2</li>\n<li>Now checks <code>execute-sql</code> permission before running the query to find the column names.</li>\n<li>Charts now display interactive tooltips.</li>\n<li>Fixed a bug where <code>waffleY</code> charts were not described to the agent.</li>\n</ul>\n</blockquote>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/datasette-agent\">datasette-agent</a></p>",
"@_type": "html"
},
"updated": "2026-05-20T14:52:16+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "datasette-agent"
}
],
"published": "2026-05-20T14:52:16+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/llm-gemini-2/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/llm-gemini-2/#atom-everything"
},
"title": "llm-gemini 0.32",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/simonw/llm-gemini/releases/tag/0.32\">llm-gemini 0.32</a></p>\n <blockquote>\n<ul>\n<li>New model <code>gemini-3.5-flash</code> for <a href=\"https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-5/\">Gemini 3.5 Flash</a>.</li>\n</ul>\n</blockquote>\n<p>See also my <a href=\"https://simonwillison.net/2026/May/19/gemini-35-flash/\">notes on Gemini 3.5 Flash</a>, and <a href=\"https://simonwillison.net/2026/May/19/gemini-35-flash/#a-pelican-on-a-bicycle\">the pelican</a> I drew using this upgrade to the plugin.</p>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/llm\">llm</a>, <a href=\"https://simonwillison.net/tags/gemini\">gemini</a></p>",
"@_type": "html"
},
"updated": "2026-05-19T23:46:27+00:00",
"category": [
{
"@_term": "llm"
},
{
"@_term": "gemini"
}
],
"published": "2026-05-19T23:46:27+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/gemini-35-flash/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/gemini-35-flash/#atom-everything"
},
"title": "Gemini 3.5 Flash: more expensive, but Google plan to use it for everything",
"summary": {
"#text": "<p>Today at Google I/O, Google <a href=\"https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-5/\">released Gemini 3.5 Flash</a>. This one skipped the <code>-preview</code> modifier and went straight to general availability, and Google appear to be using it for a whole lot of their key products:</p>\n<blockquote>\n<p>3.5 Flash is available today to billions of people globally:</p>\n<ul>\n<li>For everyone via the Gemini app and AI Mode in <a href=\"https://blog.google/products-and-platforms/products/search/search-io-2026\">Google Search</a>\n</li>\n<li>For developers in our agent-first development platform Google Antigravity and Gemini API in Google AI Studio and Android Studio</li>\n<li>For enterprises in Gemini Enterprise Agent Platform and Gemini Enterprise.</li>\n</ul>\n</blockquote>\n<p>As usual with Gemini, the most interesting details are tucked away in the <a href=\"https://ai.google.dev/gemini-api/docs/whats-new-gemini-3.5\">What's new in Gemini 3.5 Flash</a> developer documentation. It mostly has the same set of platform features as the previous Gemini 3.x series, albeit with no <a href=\"https://ai.google.dev/gemini-api/docs/computer-use\">computer use</a>. The model ID is <code>gemini-3.5-flash</code>. The knowledge cut-off is January 2025, and it supports 1,048,576 input tokens and 65,536 maximum output tokens.</p>\n<p>Google are also pushing a new <a href=\"https://ai.google.dev/gemini-api/docs/interactions\">Interactions API</a>, currently in beta, which looks to me like their version of the patterns introduced by <a href=\"https://developers.openai.com/api/reference/responses/overview\">OpenAI Responses</a> - in particular server-side history management.</p>\n<h4 id=\"the-price-has-gone-up\">The price has gone up</h4>\n<p>Gemini 3.5 Flash is accompanied by a notable price bump. The previous models in the \"Flash\" family were <a href=\"https://ai.google.dev/gemini-api/docs/models/gemini-3-flash-preview\">Gemini 3 Flash Preview</a> and <a href=\"https://ai.google.dev/gemini-api/docs/models/gemini-3.1-flash-lite\">Gemini 3.1 Flash-Lite</a>. The new 3.5 Flash is 3x the price of 3 Flash Preview and 6x the price of 3.1 Flash-Lite (see <a href=\"https://www.llm-prices.com/#sel=gemini-3-flash-preview%2Cgemini-3.5-flash%2Cgemini-3.1-flash-lite-preview\">price comparison here</a>).</p>\n<p>At $1.50/million input and $9/million output it's getting close in price to Google's Gemini 3.1 Pro, which is $2 and $12.</p>\n<p>The Gemini team promise that 3.5 Pro will roll out \"next month\" - presumably at an even higher price.</p>\n<p>This fits a trend: OpenAI's GPT-5.5 was 2x the price of GPT-5.4, and Claude Opus 4.7 is around 1.46x the price of 4.6 when you take the <a href=\"https://simonwillison.net/2026/Apr/20/claude-token-counts/\">new tokenizer into account</a>.</p>\n<p>Given the price increase it's interesting to see Google roll it out for so many of their own free-to-consumer products. It feels like all three of the major AI labs are starting to probe the price tolerance of their API customers.</p>\n<p>Artificial Analysis publish the cost to run their proprietary benchmark against models, which is a useful way to take things like tokenization and increased volume of reasoning tokens into account. Some numbers worth comparing:</p>\n<ul>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gemini-3-5-flash\">Gemini 3.5 Flash (high)</a>: $1,551.60</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gemini-3-1-pro-preview\">Gemini 3.1 Pro Preview</a>: $892.28</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gemini-3-flash-reasoning\">Gemini 3 Flash Preview (Reasoning)</a>: $278.26</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gemini-3-1-flash-lite-preview\">Gemini 3.1 Flash-Lite Preview</a>: $93.60</li>\n</ul>\n<p>Running the benchmark for 3.5 Flash (high) cost significantly more than 3.1 Pro Preview!</p>\n<p>Here are some numbers from other vendors:</p>\n<ul>\n<li>\n<a href=\"https://artificialanalysis.ai/models/claude-opus-4-7\">Claude Opus 4.7 (Adaptive Reasoning, Max Effort)</a>: $5,117.14</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/claude-opus-4-7-non-reasoning\">Claude Opus 4.7 (Non-reasoning, High Effort)</a>: $1,217.23</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gpt-5-5\">GPT-5.5 (xhigh)</a>: $3,357.00</li>\n<li>\n<a href=\"https://artificialanalysis.ai/models/gpt-5-5-medium\">GPT-5.5 (medium)</a>: $1,199.14</li>\n</ul>\n<h4 id=\"a-pelican-on-a-bicycle\">A pelican on a bicycle</h4>\n<p>I ran \"Generate an SVG of a pelican riding a bicycle\" <a href=\"https://gist.github.com/simonw/09cc5a5545d7e75b33b75ffa92a34601\">against the Gemini API</a> and got back this pelican, which is a <em>lot</em>:</p>\n<p><img src=\"https://static.simonwillison.net/static/2026/gemini-3.5-flash.png\" alt=\"Black background, bats in the sky against a stylized moon. Pelican is funky looking. Very good beak. Bicycle frame is a bit twisted, and the bar from pedals to back wheel is missing. Bike lamp illuminates the road in front. Quite stylish.\" style=\"max-width: 100%;\" /></p>\n<p>From the code comments: <code><!-- Pelican Eye / Sunglasses (Cool Retro Aviators) --></code></p>\n<p><a href=\"https://news.ycombinator.com/item?id=48196570#48198275\">hedgehog on Hacker News</a>:</p>\n<blockquote>\n<p>That pelican looks like it's in Miami for a crypto conference.</p>\n</blockquote>\n<p>That one cost me 11 input tokens and 14,403 output tokens, for a total cost of <a href=\"https://www.llm-prices.com/#it=11&ot=14403&sel=gemini-3.5-flash\">just under 13 cents</a>.</p>\n \n <p>Tags: <a href=\"https://simonwillison.net/tags/google\">google</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/gemini\">gemini</a>, <a href=\"https://simonwillison.net/tags/llm-pricing\">llm-pricing</a>, <a href=\"https://simonwillison.net/tags/pelican-riding-a-bicycle\">pelican-riding-a-bicycle</a>, <a href=\"https://simonwillison.net/tags/llm-release\">llm-release</a></p>",
"@_type": "html"
},
"updated": "2026-05-19T22:40:25+00:00",
"category": [
{
"@_term": "google"
},
{
"@_term": "ai"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "gemini"
},
{
"@_term": "llm-pricing"
},
{
"@_term": "pelican-riding-a-bicycle"
},
{
"@_term": "llm-release"
}
],
"published": "2026-05-19T22:40:25+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/datasette-llm-accountant/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/datasette-llm-accountant/#atom-everything"
},
"title": "datasette-llm-accountant 0.1a4",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-llm-accountant/releases/tag/0.1a4\">datasette-llm-accountant 0.1a4</a></p>\n <blockquote>\n<ul>\n<li>Fixed bug tracking chains of responses. Refs <a href=\"https://github.com/datasette/datasette-llm/issues/7\">datasette-llm#7</a></li>\n</ul>\n</blockquote>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/datasette\">datasette</a>, <a href=\"https://simonwillison.net/tags/llm\">llm</a></p>",
"@_type": "html"
},
"updated": "2026-05-19T20:45:43+00:00",
"category": [
{
"@_term": "datasette"
},
{
"@_term": "llm"
}
],
"published": "2026-05-19T20:45:43+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/llm-gemini/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/llm-gemini/#atom-everything"
},
"title": "llm-gemini 0.32a0",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/simonw/llm-gemini/releases/tag/0.32a0\">llm-gemini 0.32a0</a></p>\n <blockquote>\n<ul>\n<li>Compatible with <code>llm>=0.32a0</code> alpha - adds the ability to stream reasoning tokens.</li>\n</ul>\n</blockquote>\n \n \n <p>Tags: <a href=\"https://simonwillison.net/tags/llm\">llm</a>, <a href=\"https://simonwillison.net/tags/gemini\">gemini</a></p>",
"@_type": "html"
},
"updated": "2026-05-19T20:36:23+00:00",
"category": [
{
"@_term": "llm"
},
{
"@_term": "gemini"
}
],
"published": "2026-05-19T20:36:23+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/datasette-llm/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/datasette-llm/#atom-everything"
},
"title": "datasette-llm 0.1a8",
"summary": {
"#text": "<p><strong>Release:</strong> <a href=\"https://github.com/datasette/datasette-llm/releases/tag/0.1a8\">datasette-llm 0.1a8</a></p>\n <blockquote>\n<ul>\n<li>Fix for bug where <code>llm_prompt_context()</code> hook did not fully collect chains of responses. #7</li>\n</ul>\n</blockquote>",
"@_type": "html"
},
"updated": "2026-05-19T20:28:16+00:00",
"published": "2026-05-19T20:28:16+00:00"
},
{
"id": "https://simonwillison.net/2026/May/19/5-minute-llms/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/19/5-minute-llms/#atom-everything"
},
"title": "The last six months in LLMs in five minutes",
"summary": {
"#text": "<p>I put together these annotated slides from my five minute lightning talk at PyCon US 2026, using the <a href=\"https://tools.simonwillison.net/annotated-presentations\">latest iteration</a> of my <a href=\"https://simonwillison.net/2023/Aug/6/annotated-presentations/\">annotated presentation tool</a>.</p>\n\n<div class=\"slide\" id=\"5-minutes-llms.001.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.001.jpeg\" alt=\"The last six months in LLMs in\nfive minutes\n\nSimon Willison - simonwillison.net\n\nPyCon US 2026 Lightning Talk\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.001.jpeg\">#</a>\n <p>I presented this lightning talk at PyCon US 2026, attempting to summarize the last six months of developments in LLMs in five minutes.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.002.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.002.jpeg\" alt=\"The November inflection point\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.002.jpeg\">#</a>\n <p>Six months is a pretty convenient time period to cover, because it captures what I've been calling the <a href=\"https://simonwillison.net/tags/november-2025-inflection/\">November 2025 inflection point</a>. November was a critical month in LLMs, especially for coding.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.003.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.003.jpeg\" alt=\"The “best” model changed hands 5 times\nbetween Anthropic, OpenAl and Google\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.003.jpeg\">#</a>\n <p>For one thing, the supposedly \"best\" model (depending mostly on vibes) changed hands five times between the three big providers.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.004.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.004.jpeg\" alt=\"Generate an SVG of a\npelican riding a bicycle\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.004.jpeg\">#</a>\n <p>As always, I'm using my <a href=\"https://simonwillison.net/tags/pelican-riding-a-bicycle/\">Generate an SVG of a pelican riding a bicycle</a> test to help illustrate the differences between the models.</p>\n<p>Why this test? Because pelicans are hard to draw, bicycles are hard to draw, pelicans <em>can't ride bicycles</em>... and there's zero chance any AI lab would train a model for such a ridiculous task.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.005.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.005.jpeg\" alt=\"Five pelicans, one for each of the following models. Varying qualities!\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.005.jpeg\">#</a>\n <p>At the start of November the widely acknowledged \"best\" model was Claude Sonnet 4.5, released on <a href=\"https://simonwillison.net/2025/Sep/29/claude-sonnet-4-5/\">29th September</a>. It drew me this pelican.</p>\n<p>In November it was overtaken by <a href=\"https://simonwillison.net/2025/Nov/13/gpt-51/\">GPT-5.1</a>, then <a href=\"https://simonwillison.net/2025/Nov/18/gemini-3/\">Gemini 3</a>, then <a href=\"https://simonwillison.net/2025/Nov/19/gpt-51-codex-max/\">GPT-5.1 Codex Max</a>, and then Anthropic took the crown back again with <a href=\"https://simonwillison.net/2025/Nov/24/claude-opus/\">Claude Opus 4.5</a>.</p>\n<p>I think Gemini 3 drew the best pelican out of this lot, but pelicans aren't everything. Most practitioners will agree that Opus 4.5 held the crown for the next couple of months.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.006.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.006.jpeg\" alt=\"The coding agents got good\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.006.jpeg\">#</a>\n <p>It took a little while for this to become clear, but the real news from November was that the coding agents got <em>good</em>.</p>\n<p>OpenAI and Anthropic had spent most of 2025 running <a href=\"https://simonwillison.net/2025/Dec/19/andrej-karpathy/\">Reinforcement Learning from Verifiable Rewards</a> to increase the quality of code written by their models, especially when paired up with their Codex and Claude Code agent harnesses.</p>\n<p>In November the results of this work became apparent. Coding agents went from often-work to mostly-work, crossing a quality barrier where you could use them as a daily-driver to get real work done, without needing to spend most of your time fixing their stupid mistakes.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.007.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.007.jpeg\" alt=\"Screenshot of "Initial commit" on GitHub to steipete/Warelay, commit f6dd362, steipete authored on Nov 24, 2025\n\nIt's a copy of the MIT license\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.007.jpeg\">#</a>\n <p>Also in November, this happened - the first commit to an obscure (back then) repo called \"Warelay\" by some guy called Pete.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.008.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.008.jpeg\" alt=\"December/January\n(A little bit of LLM psychosis)\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.008.jpeg\">#</a>\n <p>Over the holiday period, from December to January, a whole lot of us took advantage of the break to have a poke at these new models and coding agents and see what they could do.</p>\n<p>They could do a lot! Some of us got a little bit over-excited. I had my own short-lived bout of a form of LLM psychosis as I started spinning up wildly ambitious projects to see how far I could push them.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.009.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.009.jpeg\" alt=\"micro-javascript playground\nExecute JavaScript code in a sandboxed micro-javascript environment powered by Pyodide\n\nvar numbers = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];\nvar doubled = numbers.map(n => n * 2);\nconsole.log('Doubled: "', doubled);\nvar evens = numbers.filter(n => n % 2 === 0);\nconsole.log('Evens: ', evens);\nvar sum = numbers.reduce((a, b) => a + b, @);\nconsole.log('Sum:", sum);\n\nOutput 27\nDoubled: [2, 4, 6, 8, 10, 12, 14, 16, 18, 20]\nEvens: [2, 4, 6, 8, 10]\nSum: 55\nExecution time: 8.00ms\nAbout: micro-javascript is a pure Python JavaScript interpreter with configurable memory and time limits. This playground runs entirely in your browser using\nPyodide (Python compiled to WebAssembly). View on GitHub\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.009.jpeg\">#</a>\n <p>One of my projects was a vibe-coded implementation of JavaScript in Python - a loose port of <a href=\"https://github.com/bellard/mquickjs\">MicroQuickJS</a> - which I called <a href=\"https://github.com/simonw/micro-javascript\">micro-javascript</a>. You can try it out in your browser in <a href=\"https://simonw.github.io/micro-javascript/playground.html\">this playground</a>.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.010.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.010.jpeg\" alt=\"JavaScript running in Python running in Pyodide running in WebAssembly running in JavaScript\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.010.jpeg\">#</a>\n <p>That playground demo shows JavaScript code run using my micro-javascript library, in Python, running inside Pyodide, running in WebAssembly, running in JavaScript, running in a browser!</p>\n<p>It's pretty cool! But did anyone out there <em>need</em> a buggy, slow, insecure half-baked implementation of JavaScript in Python?</p>\n<p>They did not. I have quite a few other projects from that holiday period that I have since quietly retired!</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.011.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.011.jpeg\" alt=\"February 2026\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.011.jpeg\">#</a>\n <p>On to February. Remember that Warelay project that had its first commit at the end of November?</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.012.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.012.jpeg\" alt=\"Warelay → CLAWDIS → CLAWDBOT →\nClawdbot → Moltbot →🦞 OpenClaw\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.012.jpeg\">#</a>\n <p>In December and January it had gone through <a href=\"https://simonwillison.net/2026/May/16/openclaw-names/\">quite a few name changes</a>... and by February it was taking the world by storm under its final name, <a href=\"https://openclaw.ai/\">OpenClaw</a>.</p>\n<p>The amount of attention it got is pretty astonishing for a project that was less than three months old.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.013.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.013.jpeg\" alt=\"Generic term: Claw\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.013.jpeg\">#</a>\n <p>OpenClaw is a \"personal AI assistant\", and we actually got a generic term for these, based on NanoClaw and ZeroClaw and suchlike... they're called <strong>Claws</strong>.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.014.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.014.jpeg\" alt=\"An aquarium for your Claw\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.014.jpeg\">#</a>\n <p>Mac Minis started to sell out around Silicon Valley, because people were buying them to run their Claws.</p>\n<p><a href=\"https://www.dbreunig.com/\">Drew Breunig</a> joked to me that this is because they're the new digital pets, and a Mac Mini is the perfect aquarium for your Claw.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.015.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.015.jpeg\" alt=\"Alfred Molina's Doc Ock in Spider-Man 2, tearing apart a New York subway train with his four claws.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.015.jpeg\">#</a>\n <p>My favourite metaphor for Claws is Alfred Molina's Doc Ock in the 2004 movie Spider-Man 2. His claws were powered by AI, and were perfectly safe provided nothing damaged his inhibitor chip... after which they turned evil and took over.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.016.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.016.jpeg\" alt=\"Gemini 3.1 Pro\n\nA really good illustration of a pelican riding a bicycle.\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.016.jpeg\">#</a>\n <p>Also in February: Gemini 3.1 Pro came out, and drew me a <em>really good pelican riding a bicycle</em>. Look at this! It's even got a fish in its basket.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.017.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.017.jpeg\" alt=\"Gemini 3 Pro pelican contrasted with Gemini 3.1 Pro, as animated SVGs\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.017.jpeg\">#</a>\n <p>And then Google's Jeff Dean <a href=\"https://simonwillison.net/2026/Feb/19/gemini-31-pro/#jeff-dean\">tweeted this video</a> of an animated pelican riding a bicycle, plus a frog on a penny-farthing and a giraffe driving a tiny car and an ostrich on roller skates and a turtle kickflipping a skateboard and a dachshund driving a stretch limousine.</p>\n<p>So maybe the AI labs have been paying attention after all!</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.018.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.018.jpeg\" alt=\"April 2026\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.018.jpeg\">#</a>\n <p>A lot of stuff happened just in the past month.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.019.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.019.jpeg\" alt=\"Gemma 4 26B-A4B (17.99GB)\n\nA pretty decent pelican riding a bicycle, though the bike is a bit mis-shapen.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.019.jpeg\">#</a>\n <p>Google released the <a href=\"https://simonwillison.net/2026/Apr/2/gemma-4/\">Gemma 4</a> series of models, which are the most capable open weight models I've seen from a US company.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.020.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.020.jpeg\" alt=\"GLM-5.1\nMIT, 754B parameter, 1.51TB!\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.020.jpeg\">#</a>\n <p>Also last month, Chinese AI lab GLM came out with <a href=\"https://simonwillison.net/2026/Apr/7/glm-51/\">GLM-5.1</a> - an open weight 1.5TB monster! This is a very effective model... if you can afford the hardware to run it.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.021.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.021.jpeg\" alt=\"\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.021.jpeg\">#</a>\n <p>GLM-5.1 drew me this very competent pelican on a bicycle.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.022.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.022.jpeg\" alt=\"The bike is wonky, the pelican is floating.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.022.jpeg\">#</a>\n <p>... though when it <a href=\"https://gisthost.github.io/?73bb6808b18c2482f66e5f082c75f36e\">tried to animate it</a> the bicycle bounced off into the top and the bicycle got warped.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.023.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.023.jpeg\" alt=\"Screenshot of Bluesky\n\nCharles\n@charles.capps.me\nI think you should pester it with another animal using another method of locomotion. \n\nSomething tells me it was trained for this. I can't quite put my finger on it. /s\n\nNORTH VIRGINIA OPOSSUM ON AN E-SCOOTER!!\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.023.jpeg\">#</a>\n <p>Charles <a href=\"https://bsky.app/profile/charles.capps.me/post/3miwrn42mjc2t\">on Bluesky</a> suggested I try it with a North Virginia Opossum on an E-scooter</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.024.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.024.jpeg\" alt=\"NORTH VIRGINIA OPOSSUM\nCRUISING THE COMMONWEALTH SINCE DUSK\n\nAnd a really cool illustration of a possum.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.024.jpeg\">#</a>\n <p>And it did this! I've tried this on other models and they don't even come close. \"Cruising the commonwealth since dusk\" is perfect. It's <a href=\"https://static.simonwillison.net/static/2026/glm-possum-escooter.html\">animated too</a>.</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.025.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.025.jpeg\" alt=\"Qwen3.6-35B-A3B is a 20.9GB file that runs on my laptop\n\nIt drew a better pelican on a bicycle than Opus 4.7, which messed up the bicycle frame.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.025.jpeg\">#</a>\n <p>The other neat Chinese open weight models in April came from Qwen. <a href=\"https://simonwillison.net/2026/Apr/16/qwen-beats-opus/\">Qwen3.6-35B-A3B on my laptop drew me a better pelican than Claude Opus 4.7</a>. That's a 20.9GB open weights model that runs on my laptop!</p>\n<p>(I think this mainly demonstrates that the pelican on the bicycle has firmly exceeded its limits as a useful benchmark.)</p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.026.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.026.jpeg\" alt=\"Claude Sonnet 4.5 pelican for comparison.\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.026.jpeg\">#</a>\n <p>Here's that Claude Sonnet 4.5 pelican from September for comparison. </p>\n </div>\n</div>\n<div class=\"slide\" id=\"5-minutes-llms.027.jpeg\">\n <img loading=\"lazy\" src=\"https://static.simonwillison.net/static/2026/5-minutes-llms/5-minutes-llms.027.jpeg\" alt=\"The themes of the past 6 months:\nCoding agents got really good\nLocal models wildly outperform expectations\n\" style=\"max-width: 100%\" />\n <div><a style=\"float: right; text-decoration: none; border-bottom: none; padding-left: 1em;\" href=\"https://simonwillison.net/2026/May/19/5-minute-llms/#5-minutes-llms.027.jpeg\">#</a>\n <p>So those were the two main themes of the past six months. The coding agents got really good... and the laptop-available models, while a lot weaker than the frontier, have started wildly outperforming expectations.</p>\n </div>\n</div>\n \n <p>Tags: <a href=\"https://simonwillison.net/tags/lightning-talks\">lightning-talks</a>, <a href=\"https://simonwillison.net/tags/pycon\">pycon</a>, <a href=\"https://simonwillison.net/tags/speaking\">speaking</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/local-llms\">local-llms</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/annotated-talks\">annotated-talks</a>, <a href=\"https://simonwillison.net/tags/pelican-riding-a-bicycle\">pelican-riding-a-bicycle</a>, <a href=\"https://simonwillison.net/tags/coding-agents\">coding-agents</a></p>",
"@_type": "html"
},
"updated": "2026-05-19T01:09:44+00:00",
"category": [
{
"@_term": "lightning-talks"
},
{
"@_term": "pycon"
},
{
"@_term": "speaking"
},
{
"@_term": "ai"
},
{
"@_term": "generative-ai"
},
{
"@_term": "local-llms"
},
{
"@_term": "llms"
},
{
"@_term": "annotated-talks"
},
{
"@_term": "pelican-riding-a-bicycle"
},
{
"@_term": "coding-agents"
}
],
"published": "2026-05-19T01:09:44+00:00"
},
{
"id": "https://simonwillison.net/2026/May/18/sighting-362781627/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/18/sighting-362781627/#atom-everything"
},
"title": "Glaucous-winged Gull, Brown Pelican, Snowy Egret, Canada Goose",
"summary": {
"#text": "<p><img src=\"https://static.inaturalist.org/photos/662161673/large.jpg\" alt=\"Glaucous-winged Gull\"></p><p><img src=\"https://static.inaturalist.org/photos/662161721/large.jpg\" alt=\"Glaucous-winged Gull\"></p><p><img src=\"https://static.inaturalist.org/photos/662161937/large.jpg\" alt=\"Brown Pelican\"></p><p><img src=\"https://static.inaturalist.org/photos/662161148/large.jpg\" alt=\"Snowy Egret\"></p><p><img src=\"https://static.inaturalist.org/photos/662161189/large.jpg\" alt=\"Snowy Egret\"></p><p><img src=\"https://static.inaturalist.org/photos/662160828/large.jpg\" alt=\"Canada Goose\"></p><p><img src=\"https://static.inaturalist.org/photos/662160866/large.jpg\" alt=\"Canada Goose\"></p><p>Glaucous-winged Gull, Brown Pelican, Snowy Egret, Canada Goose, in Los Angeles River, CA, US</p><p>I'm heading home from PyCon US today so I went on a last morning walk to try and spot a pelican. I saw one! Didn't get a great photo of that, but I did see some goslings down by the swan boat lake.</p>",
"@_type": "html"
},
"updated": "2026-05-18T14:51:00+00:00",
"published": "2026-05-18T14:51:00+00:00"
},
{
"id": "https://simonwillison.net/2026/May/17/gds-weighs-in/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/17/gds-weighs-in/#atom-everything"
},
"title": "GDS weighs in on the NHS's decision to retreat from Open Source",
"summary": {
"#text": "<p><strong><a href=\"https://shkspr.mobi/blog/2026/05/gds-weighs-in-on-the-nhss-decision-to-retreat-from-open-source/\">GDS weighs in on the NHS's decision to retreat from Open Source</a></strong></p>\nTerence Eden continues his coverage of the NHS' <a href=\"https://shkspr.mobi/blog/2026/05/nhs-goes-to-war-against-open-source/\">poorly considered decision</a> to close down access to their open source repositories in response to vulnerabilities reported to them as part of <a href=\"https://simonwillison.net/2026/Apr/7/project-glasswing/\">Project Glasswing</a>.</p>\n<p>Now the Government Digital Service have joined the conversation with <a href=\"https://www.gov.uk/guidance/ai-open-code-and-vulnerability-risk-in-the-public-sector\">AI, open code and vulnerability risk in the public sector</a>, published May 14th. Their key recommendation:</p>\n<blockquote>\n<p>Keep open by default. Making everything private adds additional delivery and policy costs, and can reduce reuse and scrutiny. Openness should remain the default posture, with closure used sparingly and deliberately. </p>\n</blockquote>\n<p>While they don't mention the NHS by name, Terence speaks the language of the civil service and interprets this as a major escalation:</p>\n<blockquote>\n<p>Within the UK's Civil Service you occasionally hear the expression \"being invited to a meeting <em>without biscuits</em>\". It implies a rather frosty discussion without any of the polite niceties of a normal meeting. In general though, even when people have severe disagreements, it is rare for tempers to fray. It is even rarer for those internal disagreements to spill over into public.</p>\n</blockquote>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/open-source\">open-source</a>, <a href=\"https://simonwillison.net/tags/security\">security</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/gov-uk\">gov-uk</a>, <a href=\"https://simonwillison.net/tags/terence-eden\">terence-eden</a>, <a href=\"https://simonwillison.net/tags/ai-ethics\">ai-ethics</a>, <a href=\"https://simonwillison.net/tags/ai-security-research\">ai-security-research</a></p>",
"@_type": "html"
},
"updated": "2026-05-17T15:59:41+00:00",
"category": [
{
"@_term": "open-source"
},
{
"@_term": "security"
},
{
"@_term": "ai"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "gov-uk"
},
{
"@_term": "terence-eden"
},
{
"@_term": "ai-ethics"
},
{
"@_term": "ai-security-research"
}
],
"published": "2026-05-17T15:59:41+00:00"
},
{
"id": "https://simonwillison.net/2026/May/16/openclaw-names/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/16/openclaw-names/#atom-everything"
},
"title": "Warelay -> OpenClaw",
"summary": {
"#text": "<p>In preparation for a lightning talk I'm giving at PyCon US <a href=\"https://us.pycon.org/2026/schedule/presentation/175/\">this afternoon</a> I decided to figure out how many names OpenClaw has <em>actually</em> had since that <a href=\"https://github.com/openclaw/openclaw/commit/f6dd362d39b8e30bd79ef7560aab9575712ccc11\">first commit</a> back in November.</p>\n<p>Thanks to this <a href=\"https://tools.simonwillison.net/python/#first_line_historypy\">first_line_history.py tool</a> (<a href=\"https://github.com/simonw/tools/blob/main/python/first_line_history.py\">code here</a>) the answer, according to the Git history of the OpenClaw README, is:</p>\n<p>Warelay → CLAWDIS → CLAWDBOT → Clawdbot → Moltbot →🦞 OpenClaw</p>\n<p>Or in detail (the output from the tool):</p>\n<pre>\n2025-11-24T11:23:15+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/16dfc1a\">16dfc1a</a> # Warelay — WhatsApp Relay CLI (Twilio)\n2025-11-24T11:41:37+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/d4153da\">d4153da</a> # 📡 Warelay — WhatsApp Relay CLI (Twilio)\n2025-11-24T17:47:57+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/343ef9b\">343ef9b</a> # 📡 warelay — WhatsApp Relay CLI (Twilio)\n2025-11-25T04:44:10+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/14b3c6f\">14b3c6f</a> # 📡 warelay — WhatsApp Relay CLI\n2025-11-25T12:48:40+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/4814021\">4814021</a> # 📡 warelay — Send, receive, and auto-reply on WhatsApp—Twilio-backed or QR-linked.\n2025-11-25T13:50:18+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/d51a3e9\">d51a3e9</a> # warelay 📡 - Send, receive, and auto-reply on WhatsApp via Twilio or QR-linked WhatsApp Web; webhook setup in one command\n2025-11-25T13:51:13+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/4d2a8a8\">4d2a8a8</a> # 📡 warelay — Send, receive, and auto-reply on WhatsApp—Twilio-backed or QR-linked.\n2025-11-25T14:52:43+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/1ef7f4d\">1ef7f4d</a> # 📡 warelay — Send, receive, and auto-reply on WhatsApp.\n2025-12-03T15:45:32+00:00 <a href=\"https://github.com/openclaw/openclaw/commit/a27ee23\">a27ee23</a> # 🦞 CLAWDIS — WhatsApp Gateway for AI Agents\n2025-12-08T12:43:13+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/17fa2f4\">17fa2f4</a> # 🦞 CLAWDIS — WhatsApp & Telegram Gateway for AI Agents\n2025-12-19T18:41:17+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/7710439\">7710439</a> # 🦞 CLAWDIS — Personal AI Assistant\n2026-01-04T14:32:47+00:00 <a href=\"https://github.com/openclaw/openclaw/commit/246adaa\">246adaa</a> # 🦞 CLAWDBOT — Personal AI Assistant\n2026-01-10T05:14:09+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/cdb915d\">cdb915d</a> # 🦞 Clawdbot — Personal AI Assistant\n2026-01-27T13:37:47-05:00 <a href=\"https://github.com/openclaw/openclaw/commit/3fe4b25\">3fe4b25</a> # 🦞 Moltbot — Personal AI Assistant\n2026-01-30T03:15:10+01:00 <a href=\"https://github.com/openclaw/openclaw/commit/9a71607\">9a71607</a> # 🦞 OpenClaw — Personal AI Assistant\n</pre>\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/openclaw\">openclaw</a>, <a href=\"https://simonwillison.net/tags/git\">git</a>, <a href=\"https://simonwillison.net/tags/tools\">tools</a></p>",
"@_type": "html"
},
"updated": "2026-05-16T20:23:30+00:00",
"category": [
{
"@_term": "openclaw"
},
{
"@_term": "git"
},
{
"@_term": "tools"
}
],
"published": "2026-05-16T20:23:30+00:00"
}
],
"title": "Simon Willison's Weblog",
"author": {
"name": "Simon Willison"
},
"@_xmlns": "http://www.w3.org/2005/Atom",
"updated": "2026-05-26T15:36:48+00:00",
"@_xml:lang": "en-us"
}
},
"entry_raw": {
"id": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything",
"link": {
"@_rel": "alternate",
"@_href": "https://simonwillison.net/2026/May/26/copilot-cowork-exfiltrates-files/#atom-everything"
},
"title": "Microsoft Copilot Cowork Exfiltrates Files",
"summary": {
"#text": "<p><strong><a href=\"https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files\">Microsoft Copilot Cowork Exfiltrates Files</a></strong></p>\nThe biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data.</p>\n<p>In this case Microsoft Copilot Cowork (yes, that's <a href=\"https://www.microsoft.com/en-us/microsoft-365/blog/2026/03/09/copilot-cowork-a-new-way-of-getting-work-done/\">a real product name</a>) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images:</p>\n<blockquote>\n<p>Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent.</p>\n</blockquote>\n<p>Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker.\n\n <p><small></small>Via <a href=\"https://news.ycombinator.com/item?id=48272354\">Hacker News</a></small></p>\n\n\n <p>Tags: <a href=\"https://simonwillison.net/tags/microsoft\">microsoft</a>, <a href=\"https://simonwillison.net/tags/security\">security</a>, <a href=\"https://simonwillison.net/tags/ai\">ai</a>, <a href=\"https://simonwillison.net/tags/prompt-injection\">prompt-injection</a>, <a href=\"https://simonwillison.net/tags/generative-ai\">generative-ai</a>, <a href=\"https://simonwillison.net/tags/llms\">llms</a>, <a href=\"https://simonwillison.net/tags/exfiltration-attacks\">exfiltration-attacks</a>, <a href=\"https://simonwillison.net/tags/lethal-trifecta\">lethal-trifecta</a></p>",
"@_type": "html"
},
"updated": "2026-05-26T15:36:48+00:00",
"category": [
{
"@_term": "microsoft"
},
{
"@_term": "security"
},
{
"@_term": "ai"
},
{
"@_term": "prompt-injection"
},
{
"@_term": "generative-ai"
},
{
"@_term": "llms"
},
{
"@_term": "exfiltration-attacks"
},
{
"@_term": "lethal-trifecta"
}
],
"published": "2026-05-26T15:36:48+00:00"
},
"stats_raw": {
"published_at": "2026-05-26T15:36:48.000Z",
"categories_count": 8,
"content_excerpt_length": 800
},
"aux_raw": {
"author": null,
"categories": [
"microsoft",
"security",
"ai",
"prompt-injection",
"generative-ai",
"llms",
"exfiltration-attacks",
"lethal-trifecta"
],
"feed_title": "Simon Willison's Weblog",
"raw_excerpt": "Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker",
"feed_site_url": "http://simonwillison.net/",
"content_excerpt": "Microsoft Copilot Cowork Exfiltrates Files The biggest challenge in designing agentic systems continues to be preventing them from enabling attackers to exfiltrate data. In this case Microsoft Copilot Cowork (yes, that's a real product name ) was allowing agents to send emails to the user's own inbox without approval... but those messages were then displayed in a way that could leak data to an attacker via rendered images: Because these messages can contain external images that trigger network requests to external websites, data can be exfiltrated when a user opens a compromised message sent by the agent. Since OneDrive can create pre-authenticated download links, a successful prompt injection could cause those links to be leaked, allowing files to be downloaded by the attacker. Via Hacker",
"feed_description": null
},
"selection_meta": {
"feed_id": "simon_willison",
"feed_priority": 8,
"lookback_days": 7,
"snapshot_version": "newsletter_rss_entry_v1",
"max_items_per_feed": 5,
"max_normalized_items": 40
},
"created_at": "2026-05-26T22:02:29.589Z",
"updated_at": "2026-05-26T22:02:29.589Z"
}