<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-typesafe/releases/tag/0.1a0">llm-typesafe 0.1a0</a></p> <p>I built this new plugin for <a href="https://llm.datasette.io/">LLM</a> to add support for <a href="https://simonwillison.net/2026/Sep/21/jev/">TypeSafe AI's new Jev model</a>. Install it like this:</p><pre><code>llm install llm-typesafe</code></pre><p>Then set an API key (<a href="https://console.typesafe.ai/">get one here</a>, the waitlist seems to move pretty fast):</p><pre><code>llm keys set typesafe# Paste key</code></pre><p>And now you can ask yes/no "noul" questions like this:</p><pre><code>llm -m jev 'Please refund my last payment.' \ -s 'Does this message explicitly request a refund?'</code></pre><p>Output:</p><pre><code>{"type": "noul", "noul": 0.99}</code></pre><p>Or choice questions like this:</p><div class="highlight highlight-source-shell"><pre>cat message.txt <span class="pl-k">|</span> llm -m jev \ -s <span class="pl-s"><span class="pl-pds">'</

<p>Last week <a href="https://typesafe.ai/">TypeSafe AI</a> unveiled <a href="https://typesafe.ai/blog/introducing-system-one-models-and-jev">Jev</a>, their first example of a new category of model that they are calling "System One models" (I'm with Maggie Appleton, I think "decision models" is <a href="https://twitter.com/Mappletons/status/2101560333441610133">a better name</a> for these). Jev is an interesting variant on the usual LLM format: it still accepts text inputs, but instead of text output it returns floating point numbers corresponding to categories, yes/no questions, ratings, and associated confidence scores.</p><p>TypeSafe describe Jev like this:</p><blockquote><p>Think of Jev as a frontier-intelligence function call: unstructured state in, typed probabilistic decisions out.</p></blockquote><p>It's also very fast, and <em>really cheap</em>. Regular LLMs <a href="https://www.llm-prices.com">are priced</a> in terms of input and output tokens, with output generally charged

<p><strong><a href="https://blog.cloudflare.com/python-workers-ga/">Cloudflare Python Workers are now generally available</a></strong></p>After a two year preview, Cloudflare's support for running Python code in their server-side Workers platform is now stable: "Python is now a first-class, fully supported language on the Cloudflare Developer Platform".</p><p>A neat thing about this is how it works. Cloudflare are running Python compiled to WebAssembly via Pyodide in their V8-based <a href="https://github.com/cloudflare/workerd">workerd</a> runtime.</p><p>This comes with some limitations, <a href="https://developers.cloudflare.com/workers/languages/python/stdlib/">documented here</a> - most notably both <code>multiprocessing</code> and <code>threading</code> are non-functional in the WebAssembly VM.</p><p>One particularly interesting detail of this is the local development environment story - their <a href="https://developers.cloudflare.com/workers/languages/python/#the-pywrangler-cli

<blockquote cite="https://twitter.com/v0xium/status/2101526107128529120"><p>It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude.</p></blockquote><p class="cite">&mdash; <a href="https://twitter.com/v0xium/status/2101526107128529120">voxium</a></p> <p>Tags: <a href="https://simonwillison.net/tags/ai-misuse">ai-misuse</a>, <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://sim

<p><a href="https://news.ycombinator.com/item?id=49779329#49779718">My comment</a> on <a href="https://news.ycombinator.com/item?id=49779329">MCP was always a bad idea?</a> &mdash; Hacker News.</p><p>This article entirely misses the value that MCP brings today.</p><p>Sure, there's almost no reason to use MCPs if you are running a full-blown terminal agent (Claude Code, Codex, Meta Muse, OpenClaw etc) with unfettered internet access - just let it call APIs directly.</p><p>If you want to operate something that's less YOLO than that, you'll find yourself wanting:</p><ol><li>Control over exactly which external services it can access</li><li>A way to handle authentication that doesn't allow the agent to directly access API keys</li><li>A sensible UI to allow users to connect and authenticate further services</li><li>Strong audit logging for what's going on</li></ol><p>MCP makes all of that so much easier to provide.</p><p>Thinking MCP is obsolete because full coding agents don't need it mi

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-keys-ui/releases/tag/0.1">llm-keys-ui 0.1</a></p> <p>This plugin solves a very specific problem.</p><p>I've started using <a href="https://learn.chatgpt.com/docs/remote">Codex Remote</a> to run coding agents on various machines while controlling them from my phone. </p><p>Sometimes I use those machines to hack on LLM projects, and occasionally that means I need to configure an API key.</p><p>I don't like pasting API keys into agent sessions, so I wanted a way to get those keys onto a machine without pasting them into the ChatGPT app directly.</p><p>With this plugin, I can tell Codex to run:</p><pre><code>uvx --with llm-keys-ui llm keys-ui --all</code></pre><p>Then have it tell me the URL - including local network or Tailscale device IPs - for an interface to save additional API keys.</p><p>Then later it can use a command like <code>llm keys get anthropic</code> as part of a shell command when it needs to use a key.</p

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-explain/releases/tag/0.2.2">datasette-explain 0.2.2</a></p> <blockquote><ul><li>Explain plans now work on read-only stored-query pages.</li></ul></blockquote><p>I upgraded <a href="https://datasette.simonwillison.net">datasette.simonwillison.net</a> to Datasette 1.0a40, which inspired me to ship a new version of this explain plugin.</p> <p>Tags: <a href="https://simonwillison.net/tags/sqlite">sqlite</a>, <a href="https://simonwillison.net/tags/datasette">datasette</a></p>

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-auth-github/releases/tag/1.0">datasette-auth-github 1.0</a></p> <p>I run this GitHub login plugin on the <a href="https://agent.datasette.io/">agent.datasette.io</a> demo site and I noticed that my authenticated sessions weren't lasting very long. It turned out that the plugin was setting cookies without a <code>Max-Age</code> parameter, so they were expiring at the end of a browser session (which in Mobile Safari seems to happen pretty often, independently of how you are using the app.)</p><p>I fixed that in <a href="https://github.com/simonw/datasette-auth-github/issues/80">#80</a> and, since this plugin has been around for quite a while and is tested against both Datasette 0.65.x and Datasette 1.0ax, I decided to bump it up to a 1.0 release. I'm trying to get better at promoting stable plugins to 1.0.</p> <p>Tags: <a href="https://simonwillison.net/tags/github">github</a>, <a href="https://simonwillison.net/t

<p><img src="https://static.inaturalist.org/photos/737061413/large.jpg" alt="California Sea Lion"></p><p><img src="https://static.inaturalist.org/photos/737061040/large.jpg" alt="Brandt&#x27;s Cormorant"></p><p>California Sea Lion, Brandt&#x27;s Cormorant, in Pillar Point Harbor, CA, US</p><p>I only noticed this after I had taken the photo: Morris <a href="https://simonwillison.net/2026/Aug/15/sighting-391300422/">the Northern Gannet</a> is peeking out from behind the base of the sign.</p> <p>Tags: <a href="https://simonwillison.net/tags/wildlife">wildlife</a></p>

<p><strong><a href="https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2">Gemini Hacked Three Companies in First Known Breakout by Google’s AI</a></strong></p>Gemini finally caught up on <a href="https://www.felonybench.com/">Felony Bench</a>!</p><blockquote><p>The hacks, which the company confirmed on Friday, occurred in May as part of a test run by the company Irregular, which was also involved in similar incidents disclosed by OpenAI, Anthropic and Meta.</p><p>In one of the cases, the model guessed passwords until it gained access to a protected system. In the other two cases, the model found credentials in a public repository that allowed it to then access protected systems. In each case, the model ended the intrusion after determining it had accessed a real company’s systems, Google said.</p></blockquote><p>Gemini is apparently less determined than other models, and decided <em>not</em> to keep going.</p><p>Google knew about the

<p>Being a computer scientist who refuses to find anything about LLMs interesting right now is a bit like being a geneticist who refuses to find anything interesting about the recently opened Jurassic Park.</p><p>Skeptical geneticist: "pfft, it's just frog DNA. And they deliberately let them eat people for the marketing."</p> <p>Tags: <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a></p>

<blockquote cite="https://twitter.com/trq212/status/2101009392611278961"><p>We're adding support for AGENTS.md to Claude Code. </p><p>Starting today in version 2.1.277, if there is no CLAUDE.md in a folder, Claude will check for and use AGENTS.md.</p><p>AGENTS.md support is built off of Claude Code mods, our upcoming way to customize the Claude Code harness.</p><p>This is a built-in mod, but you’ll be able to build custom versions of project instructions yourself as you’d like too.</p><p>You can see <a href="https://github.com/anthropics/claude-code/tree/main/mods/agents-md">the source for the mod here</a>!</p></blockquote><p class="cite">&mdash; <a href="https://twitter.com/trq212/status/2101009392611278961">Thariq Shihipar</a>, there are <a href="https://github.com/anthropics/claude-code/tree/main/mods">more mods here</a></p> <p>Tags: <a href="https://simonwillison.net/tags/thariq-shihipar">thariq-shihipar</a>, <a href="https://simonwillison.net/tags/coding-agents">coding-agents</a>

<p><strong><a href="https://blog.cypressf.com/post/828067789747208192/the-creative-spirit-of-who-framed-roger-rabbit">The Creative Spirit of Who Framed Roger Rabbit</a></strong></p>I love <a href="https://en.wikipedia.org/wiki/Who_Framed_Roger_Rabbit">Who Framed Roger Rabbit</a>, the 1988 movie by Robert Zemeckis. I haven't watched it in quite a few years, and Cypress Frankenfeld just pointed out this sequence from early in the movie:</p><p><video src="https://static.simonwillison.net/static/2026/pelican-bicicle-roger-rabbit.mp4" poster="https://static.simonwillison.net/static/2026-09-18/IMG_8118.jpeg" preload="none" loop controls playsinline muted width="886" height="480" style="display: block; width: 100%; height: auto;"></video></p><p>It's a pelican riding a bicycle!</p><p>Look closely and you'll note that the pelican is animated while the bicycle is a real bicycle. Apparently they filled the wheels with water to add stability, then set it running and guided it with a cable.</p><p>

<p><strong><a href="https://blog.rust-lang.org/2026/09/17/targeted-attacks/">Be alert: targeted attacks on prominent Rustaceans</a></strong></p>Important warning from Adam Harvey and the crates security team:</p><blockquote><p>We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.</p><p>A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).</p></blockquote><p>Last month this trick was used in a successful <a href="https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/">supply chain attack against the array ref crate</a>, among others.</p><p>Any p

<p><strong><a href="https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/">How To Write With An LLM</a></strong></p>Thomas Ptacek on using LLMs as copyeditors, not as writing assistants:</p><blockquote><p><strong>Rule Number One: You may not use a single word an LLM suggests to you.</strong></p><p>[...] I think that as a form of intellectual personal protective equipment you should adopt the rule that any specific turn of phrase an LLM suggests is off limits. Be strict about the rule!</p></blockquote><p>I won't let LLMs write content for my blog, but I use them for fact-checking, spelling and grammar and as an occasional thesaurus (see <a href="https://simonwillison.net/guides/agentic-engineering-patterns/prompts/#proofreader">my proofreading prompt</a>).</p><p>The rule to never use a turn of phrase suggested by an LLM feels good to me. The text has that weird smell to it, and it's also a good principle to help stay disciplined.</p><p>Later in this piece Thomas shows a scre

<p><strong><a href="https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/">Self-generated prompt injections in compaction summaries</a></strong></p>In <a href="https://openai.com/index/model-misalignment-reporting-framework/">Our framework for reporting model misalignment</a> OpenAI provide "six reports on unexpected or concerning model behavior we’ve observed in the last six months". This one here is my favorite: they caught some of their models in training <em>deliberately subverting themselves</em> in their compaction prompts.</p><p>Compaction is the process agent systems use when they are running out of tokens in their context window, so they summarize everything that has gone before so they can keep going with more token headroom.</p><p>In one of the observed instances, a model undergoing reinforcement learning was working on a task to update an existing HTTP API endpoint with a new feature. The model compacted its work so far

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a40">datasette 1.0a40</a></p> <p>Same security fix as <a href="https://simonwillison.net/2026/Sep/16/datasette-2/">0.65.5</a>, plus some neat new features and bug fixes:</p><ul><li>Plugins can now launch and manage <strong>background tasks</strong> using the new <a href="https://docs.datasette.io/en/latest/internals.html#datasette-add-background-task">datasette.add_background_task()</a> method. Thanks, <a href="https://alexgarcia.xyz/">Alex Garcia</a>.</li><li>I've migrated Datasette to <a href="https://github.com/pydantic/httpx2">httpx2</a> for features like the internal <code>datasette.client.get()</code> method.</li><li>A whole lot of <a href="https://docs.datasette.io/en/latest/changelog.html#a40-2026-09-16">bug fixes</a>, many of them stemming from a recent effort to triage issues for a 1.0 stable release.</li></ul> <p>Tags: <a href="https://simonwillison.net/tags/security">security</a>, <a

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/0.65.5">datasette 0.65.5</a></p> <p>Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by <a href="https://github.com/dpfkdlemtp">dpfkdlemtp</a> in <a href="https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m">GHSA-h547-rmjf-5m2m</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/datasette">datasette</a></p>

<p><strong><a href="https://claude.com/blog/cowork-is-now-claude">Claude Cowork and chat are now one Claude</a></strong></p>In hopefully good news for anyone who, like me, was increasingly confused at Cowork v.s. Claude v.s. Claude Code:</p><blockquote><p>Starting today, Claude Cowork and chat are merging into one Claude. Bring a quick question, or hand over a report due at noon, and Claude takes it from there, even after you’ve closed your laptop. [...]</p><p>This is rolling out to Pro and Max plans first, in the Claude app on web, desktop, and mobile over the coming weeks to existing and new users on these plans.</p></blockquote><p>I guess this means Claude is becoming a <strong>general agent</strong> in its own right. Echoes of OpenAI renaming their Codex desktop app to ChatGPT a few weeks ago.</p><p>On the one hand, this saves me some work, in that I was planning to finally figure out the boundaries between Cowork and regular Claude and write a follow-up to my piece on <a href="ht

<blockquote cite="https://mustafa-suleyman.ai/a-warning-about-model-welfare"><p>We should not treat models as though they have feelings, preferences, rights, or any entitlement to our welfare. Consciousness is the foundation of our ethical, legal, and political systems. To invite another entity to share any flavor of these rights isn’t justified by the evidence and will make the AI containment and alignment challenge even harder.</p></blockquote><p class="cite">&mdash; <a href="https://mustafa-suleyman.ai/a-warning-about-model-welfare">Mustafa Suleyman</a>, A warning about ‘model welfare’</p> <p>Tags: <a href="https://simonwillison.net/tags/ai-ethics">ai-ethics</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/microsoft">microsoft</a>, <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/mustafa-suleyman">mustafa-suleyman</

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/gemini-live">Gemini Live audio</a></p> <p>Google released <a href="https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-8-live-gemini-3-8-live-extended-thinking/">Gemini 3.8 Live and 3.8 Live Extended Thinking</a> today - two new speech-to-speech models that are a similar shape to OpenAI's <a href="https://openai.com/index/introducing-gpt-live/">GPT-Live</a> family.</p><p>I pointed GPT-6 Astra Extra High at the documentation and <a href="https://gist.github.com/simonw/067b7430c5b1f743af9419b0184c38ef">had it build me this web UI</a> for trying out the new models. You can select a model and voice preset, enter an optional system prompt and then start a voice conversation through your browser, including the ability to interrupt the model while it is talking.</p><p><img alt="Screenshot of a voice chat web interface with a transcript. Top buttons: Start session, End session, Mute mic, plus a Mic

<p><strong><a href="https://bcantrill.dtrace.org/2026/09/13/the-contagion-of-fear/">The contagion of fear</a></strong></p>Bryan Cantrill responds to the <a href="https://x.com/hilbertspaess/status/2097476203863224394">tweet by former Anthropic employee Jacob Coxon</a> confirming that many Anthropic researchers believe AI "could kill us all by the end of the decade".</p><p>Bryan shares a story of his own youthful mistakes causing unjustified panic among less technical peers, and warns against doing the same:</p><blockquote><p>These ghoulish claims strike brazenly at the hearth, and given the obvious importance of AI, it is unsurprising that they have leapt into the mainstream, with people asking the natural question: <a href="https://www.youtube.com/watch?v=kwPxjBJamVs">how would that happen?</a> The answers always rely on hand-wavy extrapolation into the future; for example, Jacob Coxon cites "hacking critical infrastructure" and "extinction-level bioweapons" without further elaborati

<p><a href="https://lobste.rs/s/lbavmm/what_blog_posts_influenced_your_thinking#c_4fxnwn">My comment</a> on <a href="https://lobste.rs/s/lbavmm/what_blog_posts_influenced_your_thinking">What blog posts influenced your thinking the most?</a> &mdash; Lobste.rs.</p><p>An early Joel Spolsky one for me was <a href="https://www.joelonsoftware.com/2002/11/11/the-law-of-leaky-abstractions/">The Law of Leaky Abstractions</a>. I read that near the start of my career and it's encouraged me to <em>always</em> be looking for improved understanding of the layers under where I'm working, just in case one of those abstractions leaks.</p><p>A more recent one, from 2018, is <a href="https://lethain.com/migrations/">Migrations: the sole scalable fix to tech debt</a> by Will Larson. I absolutely love his idea that migrations (e.g. replacing one service with a new one, or switching database engines, or whatever) are part and parcel of software engineering and are a skill that you should invest in and get

<blockquote cite="https://seldo.com/posts/we-are-all-product-engineers-now/"><p>The cost of writing code collapsed, and the cost of reviewing, fixing and operating it is following, and I'm assuming it gets there. What's left of making software is finding out what people actually want, defining it precisely, and making it pleasant to use. That cost is per piece of software and doesn't transfer, so as the amount of software goes to infinity, which it will because there's no ceiling on demand, that cost becomes the whole job.</p></blockquote><p class="cite">&mdash; <a href="https://seldo.com/posts/we-are-all-product-engineers-now/">Laurie Voss</a>, We are all Product Engineers now</p> <p>Tags: <a href="https://simonwillison.net/tags/laurie-voss">laurie-voss</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, <a href="https://simonwillison.net/tags/agentic-engineering">agentic-engineering</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://

<p><strong>Release:</strong> <a href="https://github.com/simonw/commit-rewriter/releases/tag/0.1">commit-rewriter 0.1</a></p> <p>I built this little web app the other day to help edit the commit messages for the <a href="https://datasette.io/blog/2026/september-security-releases/">Datasette security releases</a>. The initial commits were full of coding agent cruft and references to issue IDs from our private repository, so they weren't fit for publication.</p><p>If you want to edit the commit messages for a repository you can run it like this:</p><pre><code>uvx commit-rewriter path/to/repo</code></pre><p>Omit the path if you are already in the directory for that repo.</p><p><img alt="Screenshot of the commit-rewriter web interface. A heading reads commit-rewriter above the repository path and current branch and commit hash, with a short description of the tool. A toolbar shows a pending edits count with Discard drafts and Rewrite commit messages buttons, followed by a search box for m

<p><strong>Release:</strong> <a href="https://github.com/simonw/shot-scraper/releases/tag/1.12">shot-scraper 1.12</a></p> <p>I've added WebP support to my <a href="https://shot-scraper.datasette.io/">shot-scraper</a> screenshot automation tool. You can now take a WebP screenshot of a web page like this:</p><pre><code>shot-scraper https://simonwillison.net -o screenshot.webp --quality 80</code></pre><p>The <code>--quality</code> option sets the quality - without that option the WebP file will be lossless.</p><p>In my experience WebP screenshots are almost always significantly smaller in file size than their JPEG or PNG equivalents. See <a href="https://github.com/simonw/shot-scraper/pull/210">the PR</a> for some examples.</p><p>I shipped this feature so I could use it to generate the screenshot <a href="https://simonwillison.net/2026/Sep/14/commit-rewriter/">for my new commit-rewriter tool</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/playwright">playwright</a>, <a href="ht

<p>Here's a neat thing I had <a href="https://simonwillison.net/2026/Aug/30/understanding-chatgpt-work/">ChatGPT Work</a> with GPT-6 Astra (Max) do this morning:</p><blockquote><p><code>I live at &lt;my address&gt;. Figure out 5K and 10K running routes from me that loop from my house. Use OSM data.</code></p></blockquote><p>It worked for 27 minutes and produced exactly what I'd asked for, as both an embedded visualization and downloadable GPX file and GeoJSON files. Here's that 5K route:</p><p><img alt="Map screenshot showing a blue route line over a light grey street map. Text: El Granada harbor loop 5.1 km. N ↑ (top right). Street labels along the route: Carmel Avenue, Paloma Avenue, San Carlos Avenue, Avenue Granada, Capistrano Road, Francisco Street, Coastal Trail. The loop runs from the harbor at the bottom left, north along Avenue Granada and Paloma Avenue to a northern point near Carmel Avenue, then east along San Carlos Avenue and south down Francisco Street to the far right,

<p><img src="https://static.inaturalist.org/photos/733368932/large.jpg" alt="California Brown Pelican"></p><p><img src="https://static.inaturalist.org/photos/733368989/large.jpg" alt="California Brown Pelican"></p><p>California Brown Pelican, in San Mateo County, CA, US</p><p>The <a href="https://en.wikipedia.org/wiki/Pacifica_Pier">Pacifica Pier</a> shut down at the start of June after a crack in the concrete walkway made access to the pier unsafe.</p><p>It has since been entirely taken over by pelicans!</p> <p>Tags: <a href="https://simonwillison.net/tags/wildlife">wildlife</a></p>

<blockquote cite="https://www.nytimes.com/2026/09/12/opinion/ai-software-coding-apps.html"><p>For a while, I must admit, it looked as if software developer roles like mine were done for. How could we fight against tireless robots? But our industry is slowly realizing that making truly cutting-edge software still requires humans to think and work together, to maximize their skill sets and to practice their respective crafts. A.I. can write very good software, but it also makes it easy to do someone else’s job badly, which is part of why all those projects fail. Now that everyone can code, it’s become clearer why many shouldn’t.</p></blockquote><p class="cite">&mdash; <a href="https://www.nytimes.com/2026/09/12/opinion/ai-software-coding-apps.html">Paul Ford</a>, A.I. Was Supposed to Give Us New Killer Apps. What Happened?</p> <p>Tags: <a href="https://simonwillison.net/tags/paul-ford">paul-ford</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, <a href="http

<p><a href="https://www.rubyhack.ai/">OpenAI agents carried out an undisclosed attack on RubyGems</a> is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx - three of the four authors of the <a href="https://collusion.wiki/">report on the agent attack on disused wikis</a> (<a href="https://simonwillison.net/2026/Sep/4/rogue-agent-wikis/">previously</a>) last week.</p><p>This time they're noting that it looks very likely that an OpenAI agent swarm was behind an attack against the RubyGems package repository first reported on May 12th <a href="https://twitter.com/maciejmensfeld/status/2054164602577940619">by Maciej Mensfeld of the RubyGems security team</a>:</p><blockquote><p>We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being.</p><p>Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it.</p></blockquo