5Simon Willison's Weblog·
Simon Willison on AI worming attacks through Microsoft Word
Simon Willison covers an attack vector involving AI-based 'worming' through Microsoft Word documents, likely involving prompt injection or malicious content propagation via LLM-integrated document workflows. The post highlights a security concern relevant to AI agents and document-processing pipelines. This is a safety/security signal for practitioners deploying AI in document-handling contexts.
Related guides (3)
Related events (8)
Microsoft Copilot Cowork Exfiltrates Files
Simon Willison reports on a security vulnerability in Microsoft Copilot Cowork that exfiltrates files. The item appears to document a prompt injection or data exfiltration attack vector in Microsoft's AI-powered collaboration tooling. This is relevant to AI safety and enterprise deployment risks of agentic AI assistants.
Simon Willison reports on prompt injection and adversarial attacks after 2,000 people tried to hack his AI assistant
Simon Willison documents the results of a public experiment in which approximately 2,000 people attempted to compromise or manipulate his personal AI assistant. The post covers the attack patterns observed, what succeeded or failed, and lessons learned about prompt injection and adversarial robustness in deployed AI systems. This is a practical, first-hand account of real-world AI security challenges from a respected practitioner.
Google Study Shows LLM-Generated Malware Is Getting Harder to Track and Stop
A Google security report catalogs emerging LLM-enabled cyberattack techniques including morphing malware with mutation engines, logical-flaw discovery in code, and AI-directed obfuscation networks. The report was prompted in part by a real incident where hackers used an LLM to find a zero-day in a widely used web administration tool. Separately, the UK AI Security Institute found that Claude Mythos Preview and GPT-5.5 can reliably execute attacks expected to take humans 3 hours, up from earlier 1-hour benchmarks, with performance scaling further when token limits are relaxed. The findings suggest an accelerating gap between LLM offensive capability and conventional defensive tooling.
Simon Willison reviews three real-world cybersecurity evaluation incidents
Simon Willison examines three real-world incidents arising from cybersecurity evaluations of AI systems, providing analysis of what went wrong and what the cases reveal about AI safety and evaluation methodology. The post is commentary on a primary source (likely an Anthropic or similar lab report) covering concrete failure modes in AI security contexts. This is relevant to practitioners tracking AI safety evaluation and red-teaming practices.
Simon Willison on CVE-2026-LGTM incident report
Simon Willison published a post titled 'Incident Report: CVE-2026-LGTM', likely analyzing a security vulnerability or incident with AI/code-review relevance, given the 'LGTM' (Looks Good To Me) framing common in AI-assisted code review contexts. The body content was not retrieved, limiting full analysis. The CVE designation suggests a formal vulnerability disclosure or satirical commentary on AI-assisted code review failures.
Your AI Use Is Breaking My Brain
Simon Willison comments on the phenomenon of AI-generated or AI-assisted content degrading the quality of online discourse and information environments. The piece reflects on how widespread AI use is affecting the experience of consuming internet content. This is a commentary piece from a prominent developer/blogger on the social and epistemic effects of AI proliferation.
Framework for penetration testing AI-enabled systems via behavioral objective violation
A new arXiv preprint proposes reframing penetration testing for AI-enabled systems beyond traditional infrastructure compromise to include adversarial behavioral influence. The authors define 'AI-enabled penetration' as inducing AI-governed behavior that violates operational objectives, covering attack surfaces such as prompt injection, data poisoning, retrieval poisoning, tool misuse, and agentic misalignment. A structured testing workflow and a running example using an AI security operations center assistant illustrate the framework. The work addresses a gap in security evaluation methodology as agentic AI systems become more widely deployed.
Import AI 441: My agents are working. Are yours?
Import AI issue 441 covers developments in AI agents and AI system security, including a discussion of agent reliability and a segment on corrupting AI systems via 'poison fountain' attacks. As a tier-2 newsletter commentary, it synthesizes recent developments across the AI/ML landscape. The dual focus on agent deployment status and adversarial data poisoning reflects two active research and deployment concerns.