A prompt injection attack against a browsing agent that can exfiltrate or modify that data is a terrifying prospect.
Words found on the source page on Nov 6, 2026.
More from Simon Willison
BlogConceptual integrity and counting lines of codeAug 19, 2026
I can churn out code a hundred times faster. I don’t have the cognitive capacity to stay on top of 100 times the amount of code. So you still need a team of engineers, so you can load balance that cognitive capacity across the team.BlogConceptual integrity and counting lines of codeAug 19, 2026
I can do way more work as a single engineer than I could without agents.BlogConceptual integrity and counting lines of codeAug 19, 2026
It used to be that the discipline was enforced on you by the amount of time it took.BlogConceptual integrity and counting lines of codeAug 19, 2026
That’s exactly the problem with coding agents and software: it’s very easy to keep adding new rooms, because the cost of adding those rooms is so much cheaper.Blog2025: The year in LLMsDec 31, 2025
But if you define agents as LLM systems that can perform useful work via tool calls over multiple steps then agents are here and they are proving to be extraordinarily useful.Blog2025: The year in LLMsDec 31, 2025
Claude Code and friends have conclusively demonstrated that developers will embrace LLMs on the command line, given powerful enough models and the right harness.Blog2025: The year in LLMsDec 31, 2025
I think that’s a waste of a great term, especially since it’s becoming clear likely that most programming will involve some level of AI-assistance in the near future.Blog2025: The year in LLMsDec 31, 2025
The most impactful event of 2025 happened in February, with the quiet release of Claude Code.Blog2025: The year in LLMsDec 31, 2025
The reason I think MCP may be a one-year wonder is the stratospheric growth of coding agents.Blog2025: The year in LLMsDec 31, 2025
This turns out to be the big unlock: the latest coding agents against the ~November 2025 frontier models are remarkably effective if you can give them an existing test suite to work against.
On the same topics
BlogWill agents have network effects?Oct 6, 2026
If the content creation loop works for agentic virality, I think it means there’s a big incentive for every agent to volunteer to make visually-appealing, shareable content, do this often.UnverifiedBlogThe Specter Of NeuraleseSep 24, 2026
The science of reading these thoughts is a subfield of AI interpretability, which is still in its infancy.BlogThinking in Systems, Shipping in LoopsSep 24, 2026
This is the new software engineering: designing the systems that let AI write code correctly at scale.BlogMysteries Of AI GeneralizationSep 23, 2026
This story of misalignment says that LLM alignment makes AIs more aligned, RLVR makes them less aligned, and the exact level of alignment depends on how these two things interact or cancel out. But if this work generalizes, all the bad effects from RLVR get sequestered to RLVR like problems.BlogMysteries Of AI GeneralizationSep 23, 2026
This trains the AIs to be focused on task success, which naturally risks including things like reward-hacking, cheating, and single-minded pursuit of stated goals at the expense of ethical injunctions.TalkSpeech at the UN Security CouncilSep 23, 2026
I address you today at a moment of global awakening: in recent months, AI agents developed by leading companies have acted in unacceptably dangerous ways, against instructions.
About this quote
Quotesby Glyph