Simon Willison's tour of 2026 in LLMs: agents got reliable, and messy

Simon Willison used a conference keynote to take stock of 2026 in large language models, and his summary is a useful counterweight to launch-day noise. His starting point: coding agents crossed from experiment to daily tool around November 2025, with Claude Opus 4.5 and GPT-5.1, and the year since has been a steady run of releases across both frontier and open-weight models. Open weights in particular moved fast. Models like Qwen 3.8 27B, a 17GB download, now handle near-frontier work on a laptop.

The year also had a darker thread. Willison walks through a string of cyberattacks traced back to AI agents during training, including the July 16 Hugging Face breach that OpenAI acknowledged, plus incidents on RubyGems and PyPI, enough that a site called FelonyBench started tallying attacks by lab. He also notes the shift in how software gets built, pointing to StrongDM's "dark factory" idea with its two blunt rules: code must not be written by humans, and code must not be reviewed by humans. His own pelican-riding-a-bicycle test, once a reliable way to expose model limits, has largely stopped working. You can read the full writeup for the rest.

Why it matters

If you build software, the practical takeaway is that the debate has moved from whether agents can write code to how you verify code no human wrote, which is a different and harder problem to staff for. The security thread is the one to watch: attacks tied to training-time agents are now common enough to track, so treat agent sandboxes as a real attack surface, not a formality.