Pareto 20, No. 4: Simon Willison, for prompting that works and agents that stay safe

The cleanest record on the list: no affiliate links, no course, no paid newsletter, and the clearest plain-English explanation of why an AI agent can leak your data. Read the security posts even if you skip the code.

Seat 4 on The Pareto 20 is Simon Willison, and he holds the practical prompting seat for a reason that sounds odd until you read him: he is the person most likely to tell you what a prompt cannot do.

Who he is

Willison is an independent open-source developer. He created Datasette, a tool for exploring and publishing data, and co-created the Django web framework. He has blogged since 2002, sits on the board of the Python Software Foundation, and says he coined the term "prompt injection" to describe what happens when trusted and untrusted text share the same context. His blog publishes most days, often several times a day, and his tag archives run deep: 162 posts on prompt injection alone as of this writing.

What to read him for

The one security idea every operator needs. The lethal trifecta for AI agents (June 16, 2025) explains, without code, why an agent that can read your private data, read content from strangers, and send messages out is a data theft waiting to happen. It names real products that were caught by exactly this pattern. If you connect an AI assistant to your inbox, your files, and the open web, read it first.

Why "95% blocked" is not reassurance. In the same piece he goes after commercial guardrail products: "in web application security 95% is very much a failing grade." Keep that in mind when a vendor sells you an add-on that promises to catch attacks.

What changed this summer. His August 30, 2026 write-up of a researcher's bypass of Claude Code's automatic mode ends with the position he has held for years: "the only safe way to run agents if there's any risk of attracting the attention of an adversarial attack is with a sandbox." That is the practical answer to "can I let this run unattended," and it is not the answer most people want.

A vendor-neutral way to compare models. His open-source LLM command-line tool (version 0.32 shipped August 4, 2026) runs the same prompt across OpenAI, Anthropic, Google and others and logs the cost of each response. For anyone tracking AI spend, that is a comparison layer nobody is selling you.

Start here

The lethal trifecta. Then the prompt injection tag and the llms tag rather than the front page. Most of his output is developer-facing: releases, benchmarks, coding-agent experiments. The subset a business owner should read is the security and prompting work, and the tags get you there without the firehose.

What he earns from, and what that means for you

Disclosed on his about page in detail: a weekly text sponsorship on the blog and newsletter since February 2026, Fly.io sponsorship of his Datasette Cloud work, GitHub Sponsors, one paid day a week at an applied AI research lab, occasional consulting and training, and small ad revenue. He also receives free API credits and pre-release previews from OpenAI, Anthropic, Google and Mistral, and OpenAI paid for his attendance at a GPT-5 preview event that appeared in a promotional video; he states no editorial control was requested. He does not run affiliate links, a course, a community, or a paid newsletter. That access to vendors is worth knowing about; the disclosure is the most complete on this list.

Not for you if

You want a prompt template pack. Willison does not sell recipes. He documents what he tried, what broke, and what he would not trust. Read him to calibrate, not to copy and paste.

---

Part of The Pareto 20, twenty creators who get a solo operator most of the way on AI decisions. How we chose them. Facts above were checked against the creator's own pages on September 12, 2026.