Simon Willison argues late 2025 was an inflection point, when Anthropic and OpenAI focused training on coding and coding agents began reliably doing what they were told.
Simon Willison says he now writes about 95% of his code without typing it, and that software engineers are the bellwether for other knowledge work.
Simon Willison warns that a 97% effective prompt injection filter is a failing grade, and points to Google DeepMind's CaMeL design as a promising alternative.
Coding agents now work, but security lags dangerously
Coding agents became reliable enough in late 2025 that software engineering is the first knowledge profession to feel AI's full effect. Code is easy to verify, so agents can work with little oversight, and the limits shift to validation, human stamina and trust. Prompt injection remains unsolved while adoption races ahead.
Takeaways
Coding agents crossed a threshold in late 2025. Anthropic and OpenAI spent 2025 training on coding and reasoning, and GPT-5.1 and Claude Opus 4.5 began following instructions almost every time. Code is easy to check, so engineers are the bellwether. Simon now writes about 95% of his code without typing it.
Dark factories ship software nobody reads. StrongDM tested access-management software with swarms of simulated employees and a self-built simulation of tools like Slack and Jira, reportedly spending about $10,000 a day on tokens. Simon says handcrafted software will gain value, and his own untested tools feel untrustworthy.
Bottlenecks moved from writing code to validation. With code cheap, process, product design and validation now limit progress. Simon prototypes three versions of a feature and prefers testing with real users over AI simulations. He finds AI very good at the first two-thirds of brainstorming.
Agents amplify experience and exhaust their users. Thoughtworks found AI coding helps experienced engineers most, and the middle of the career ladder may be most at risk. Simon is wiped out by late morning. Cloudflare and Shopify hired about a thousand interns in 2025 as onboarding time fell.
Prompt injection is unsolved and a disaster looms. Simon's lethal trifecta describes agents that can reach private data and send it out after reading malicious instructions. He calls a 97% effective filter a failing grade and predicts a Challenger-style disaster. Google DeepMind's CaMeL, splitting privileged and quarantined agents, looks promising.
Personal AI claws are popular and insecure. Simon calls OpenClaw and the wave of claw assistants catastrophically insecure yet hugely popular, with over 1,000 contributors. He thinks Claude Opus mostly spots and refuses unsafe instructions, which is one reason complete disasters have not yet happened.
Agentic engineering patterns
Writing code is cheap now, so the skill is making cheap code good.
Use red/green test-driven development. The agent writes tests, watches them fail, then implements. Having agents run tests is the most important habit.
Start projects from a template with one passing test, so agents follow the project's style.
Keep tools and research in public repositories, including about 193 small HTML and JavaScript tools, so agents can search them for new problems.
Tap a name to go there · tap a line to see why they are linked
On this episode 2
Show 1
Will AI eliminate jobs
Simon is not an AI doomer but worries about the economics. He hopes a tenth of white-collar knowledge work jobs will not disappear.
Lenny cites Jensen Huang's view that companies cut jobs for lack of creativity and ambition. He also notes open engineering and product roles are at their highest in about three and a half years, COVID aside, even as Block cut 4,000.