Quoting Willy Tarreau
On the kernel security list we've seen a huge bump of reports. We were between 2 and 3 per week maybe two years ago, then reached probably 10 a week over the last year with the only difference being
Simon Willison's Weblog
Quoting Greg Kroah-Hartman
Months ago, we were getting what we called 'AI slop,' AI-generated security reports that were obviously wrong or low quality. It was kind of funny. It didn't really worry us. Something happened a
Quoting Daniel Stenberg
The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. Many of them really good. I'm
Can JavaScript Escape a CSP Meta Tag Inside an Iframe?
Research: Can JavaScript Escape a CSP Meta Tag Inside an Iframe? (https://github.com/simonw/research/tree/main/test-csp-iframe-escape#readme) In trying to build my own version of Claude
The Axios supply chain attack used individually targeted social engineering
The Axios team have published a full postmortem (https://github.com/axios/axios/issues/10636) on the supply chain attack which resulted in a malware dependency going out in a release the other day
Highlights from my conversation about agentic engineering on Lenny's Podcast
I was a guest on Lenny Rachitsky's podcast, in a new episode titled An AI state of the union: We've passed the inflection point, dark factories are coming, and automation timelines
Gemma 4: Byte for byte, the most capable open models
Gemma 4: Byte for byte, the most capable open models (https://blog.google/innovation-and-ai/technology/developers-tools/gemma-4/) Four new vision-capable Apache 2.0 licensed reasoning LLMs from
March 2026 sponsors-only newsletter
I just sent the March edition of my sponsors-only monthly newsletter (https://github.com/sponsors/simonw/). If you are a sponsor (or if you start a sponsorship now) you can access it here
datasette-llm 0.1a6
Release: datasette-llm 0.1a6 (https://github.com/datasette/datasette-llm/releases/tag/0.1a6) • The same model ID no longer needs to be repeated in both the default model and allowed models
datasette-enrichments-llm 0.2a1
Release: datasette-enrichments-llm 0.2a1 (https://github.com/datasette/datasette-enrichments-llm/releases/tag/0.2a1) • The actor who triggers an enrichment is now passed to the llm.mode(...
datasette-extract 0.3a0
Release: datasette-extract 0.3a0 (https://github.com/datasette/datasette-extract/releases/tag/0.3a0) • This plugin now uses datasette-llm (https://github.com/datasette/datasette-llm) to
datasette-enrichments-llm 0.2a0
Release: datasette-enrichments-llm 0.2a0 (https://github.com/datasette/datasette-enrichments-llm/releases/tag/0.2a0) • This plugin now uses datasette-llm
datasette-llm-usage 0.2a0
Release: datasette-llm-usage 0.2a0 (https://github.com/datasette/datasette-llm-usage/releases/tag/0.2a0) • Removed features relating to allowances and estimated pricing. These are now the
datasette-llm 0.1a5
Release: datasette-llm 0.1a5 (https://github.com/datasette/datasette-llm/releases/tag/0.1a5) • The llm_prompt_context() plugin hook wrapper mechanism now tracks prompts executed within a
Quoting Soohoon Choi
I want to argue that AI models will write good code because of economic incentives. Good code is cheaper to generate and maintain. Competition is high between the AI models right now, and the ones
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
Supply Chain Attack on Axios Pulls Malicious Dependency from npm (https://socket.dev/blog/axios-npm-package-compromised) Useful writeup of today's supply chain attack against Axios, the HTTP client
datasette-llm 0.1a4
Release: datasette-llm 0.1a4 (https://github.com/datasette/datasette-llm/releases/tag/0.1a4) • Ability to configure different API keys for models based on their purpose
llm-all-models-async 0.1
Release: llm-all-models-async 0.1 (https://github.com/simonw/llm-all-models-async/releases/tag/0.1) LLM plugins can define new models in both sync
llm 0.30
Release: llm 0.30 (https://github.com/simonw/llm/releases/tag/0.30) • The register_models() plugin hook
llm-echo 0.4
Release: llm-echo 0.4 (https://github.com/simonw/llm-echo/releases/tag/0.4) • Prompts now have the input_tokens and output_tokens fields populated on the response. Tags: llm