Simon Willison's Weblog

Introducing Kimi K3.1 Pro (via) Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026".

They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which are priced the same).

The US dollar pricing is $2.00/million tokens for input and $10/million for output - the same as GPT-6.1 Sol and half the price of Claude Opus 5.5.

Moonshot's own benchmarks show Kimi as approximately level with Opus 5.5 and GPT-6 Astra - beating them on a few benchmarks, coming close on others.

Artificial Analysis scored Kimi at 55 - ahead of Claude Fable 5.1, GPT-6 Astra, and Gemini 4 Argon (all at 53) and behind only Claude Opus 5.5 (58).

This is the first time a (soon-to-be) open weight model has scored this highly against the frontier.

I tried it out via the Moonshot API using the llm openai endpoint command I added to LLM 0.32 back in August:

llm openai endpoint \
  https://api.moonshot.ai/v1 \
  --key kimi \
  -m kimi-k3.1-pro \
  "Generate an SVG of a pelican riding a bicycle" \
  --responses \
  -o reasoning_effort low \
  > kimi-k3.1-pro-pelican-low.stdout.txt \
  2> kimi-k3.1-pro-pelican-low.stderr.txt

llm openai endpoint can run prompts against any OpenAI-compatible endpoint but doesn't log the results, hence the extra options to save stdout and stderr (the reasoning trace).

Here are the pelicans I got for Kimi K3.1 Pro on the three reasoning levels it supports - low, medium, and max. This is max:

For comparison, I ran fresh pelicans against Kimi K3 on those three reasoning levels.

# 7:40 pm / ai, generative-ai, llms, llm, llm-pricing, pelican-riding-a-bicycle, llm-release, ai-in-china, moonshot, kimi

DE STAAT—FREEDOM (Official Music Video) (via) OK well this is a first for me... at 00:44 in this new music video by Dutch alternative rock band De Staat:

The visual effects are credited to Matties Grooten of Fake it or Leave it.

# 7:42 pm / music, ai, generative-ai, pelican-riding-a-bicycle

Donating Agent Skills to the Agentic AI Foundation. News today from Anthropic:

We’re committed to keeping Agent Skills open, community-driven, and vendor-neutral. Today, we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, which we co-founded with Block and OpenAI last year, and to which we donated the Model Context Protocol (MCP).

I'm pleased to note I called this one last December, when Anthropic first declared skills to be an "open standard":

I wouldn't be surprised to see this end up in the AAIF, recently the new home of the MCP specification.

Fun side note: since my blog content is available to Claude via the datasette-mcp plugin I found that post by prompting Claude to "Use simonwillison.net MCP to find if I ever talked about how I want skills to be donated to a standards body".

# 6:09 pm / standards, ai, generative-ai, llms, anthropic, model-context-protocol, skills

Today’s PHP Security Release, and How We’re Strengthening PHP Security (via) If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process.

This post from the PHP Foundation explain what went so wrong:

On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC [...]

As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.

This article from the team that discovered the original vulnerability includes a more detailed timeline of the original intended responsible disclosure:

• August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
• August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
• August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
• August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
• September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
• October 21, 2026: Patched PHP releases become available.
• October 21, 2026: Public disclosure.

# 6:41 pm / open-source, php, security, ai, ai-security-research

Panache — RTS Belle Époque pour mobile (via) Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk 1900s France and adds an animated intro!

Panache est un jeu de stratégie en temps réel pour mobile et navigateur, dans la France de la Belle Époque (vers 1900) : dirigeables, Fardiers à vapeur, Creusot cuirassés, automates en képi, Gargantua la forteresse marchante — et beaucoup de panache.

You can play Panache here - it's worth clicking that link just to experience the new intro video.

So far it's mostly just aesthetic updates as opposed to gameplay changes. The music has had a French twist added to it as well.

The new steampunk models are so cool!

Here's a page with the original Battle Drones models and that same page with the new Panache alternatives.

This is a comparison of the original and the new design for the Goliath:

# 4:25 pm / game-design, open-source

eMudhra Intermediate CA Compromise. This is very, very bad news:

The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

Any software that bundles a list of trusted certificates needs to be updated. This site is tracking software updates via this GitHub repository - Linux distros need to update their ca-certificates packages.

In Python world uv 0.13.4 and pip 26.2.2 and certifi 2026.10.19 have been released with upgraded certificate lists.

There's a very informative thread about this on the official Python forum.

# 11:50 pm / encryption, https, pip, python, security, uv

My obituary for programming (via) Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the puzzle of developing code:

Programming turned into one of the greatest jobs you could imagine. You got paid to work on tricky little logic puzzles. The trickier the puzzle, the more you got paid. But even pretty simple puzzles were worth a lot of money because regular people just couldn't do it! No, they needed us. They would give us a problem and we would solve it the way we wanted. We set the strategy, we made the timeline, we defined what was and was not possible.

If you're a programmer who thrives on building working systems and doesn't care too deeply about the problems solved along the way, LLMs are the gift that keeps on giving.

If directly solving those problems was a big part of your enjoyment, the loss is very real.

# 11:58 pm / programming, careers, ai, generative-ai, llms, coding-agents, deep-blue

Inline rendering with document​.currentScript. Lean Rada describes a neat trick that takes advantage of the document.currentScript property. You can use that to drop in a tiny inline <script> element that replaces itself when the page loads:

The year is <script>
document.currentScript.replaceWith(
  new Date().getFullYear())</script>

If you define a shortcut function like this:

$=(...n)=>document.currentScript.replaceWith(...n)

You get a tiny template language:

The year is <script>$(new Date().getFullYear())</script>

# 9:11 pm / javascript

Anthropic tells investors quarterly revenue up nearly 50% to $16.8bn ahead of IPO. The phrase "told investors" appears four times in this FT article, which reports on Anthropic's day of hosting investors on Wednesday. Lots of details in here from "people with knowledge of the matter".

Key things I learned from the article:

• Q1 revenue (Jan/Feb/Mar) was "about $4.8bn"
• Q2 (Apr/May/Jun) was $11.5bn
• Q3 (Jul/Aug/Sep) was $16.8bn
• In Q3: $1.70 in revenue for every $1 spent on "computing power"
• Adjusted operating margins (excluding stock-based compensation) were 11%

This point about distillation is worth quoting in full (highlight mine):

The start-up has also clamped down on “distillation” — a controversial practice whereby rival AI labs train their models on the outputs of more advanced ones.

When rival companies “distil” their models from Anthropic’s models, that involves heavy usage and spending.

Anthropic told investors on Wednesday distillation accounted for 5 per cent to 7 per cent of revenue and that they had cut it back “materially” in the third quarter of the year, said four people with direct knowledge of the matter.

Napkin maths says that if distillation was 5% of their Q2 revenue (before they cut it back in Q3) then unnamed "other labs" spent over half a billion dollars distilling Anthropic's models in that quarter!

Also notable: Anthropic appear to no longer be leaning on "annualized run-rate revenue" (previously) in these communications to their investors.

# 1:04 pm / ai, generative-ai, llms, anthropic

AI is mass decompiling games. That’s both awesome and scary. (via) Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new hardware (often in a browser using WebAssembly).

I like how this piece captures both the positives and the negatives of this new development:

Most people already realized the scary part by now. If AI can decompile games and software, then the entire tech industry is about to explode. Anybody can decompile other software and use it any way they'd like, and nobody can stop them. Companies can steal from competitors. Your paid game or app can be open-sourced against your will. This isn't exclusive to old video games, we can apply this to any software. [...]

This is also a big win for preservation. Old games can be ported, modified, enhanced, and made much more easily accessible than before. [...[

With console makers going all in on digital and games becoming entirely unplayable due to servers shutting down, this is fantastic news. We could own software we bought regardless of what the company thinks.

# 4:26 pm / computer-history, game-design, ai, webassembly, generative-ai, llms, ai-ethics, coding-agents

Redesigning source control at Anthropic (via) Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months.

In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day.

They included a chart showing those changes. I had Claude modify their chart (code here) to add markers for the public releases of each of their models in 2026:

This shows public release dates, not the date when models became available for Anthropic's internal use. My guess is that the introduction of Fable/Mythos class models is a key factor in the increased coding velocity.

"Antique" is their new code review system. The source control system is called Scion, and sounds to me like a reinvention of centralized source control along the lines of Subversion.

(Update: Anthropic credit Google's Piper and Meta's Sapling as "prior art" - it looks like the core concept of "derived data" was heavily inspired by Mononoke, the server component of Sapling.)

They had some pretty extreme requirements:

The history of our main branch alone is almost 100 GB, and a compressed working copy is over 25 GB. We perform on the order of 25 million code checkouts per day for CI, before counting developer environments, agent sandboxes, and research jobs. Fetched naively, that would be over 600 PB of git traffic per day.

The new system was built by a team of seven people, and the migration from Git was completed in five months.

When asked on Hacker News about the lack of offline support, Scion engineer Nick G replied:

Since Claude is by far the heaviest user of Scion and is necessarily online, this just wasn't important to do.

As an aside, I've been trying adversarial review in my own projects recently, where you have a model try and find flaws (I often play Claude and GPT off against each other). This note from the article reflected my own experience with that:

Anthropic also makes extensive use of adversarial review, and, while this is incredibly effective in many ways, it can also be myopic, so skilled engineers needed to steer Claude away from over-engineering parts of the system in response to hypothetical concerns.

# 11 pm / git, migrations, version-control, ai, generative-ai, llms, anthropic, agentic-engineering

Python 3.15.0 added to actions/python-versions. Bit of a niche link, but I've been waiting for this for a couple of days - I even told ChatGPT to check for it:

Clone https://github.com/actions/python-versions and git pull once an hour until they add the stable 3.15 - then tell me about it

Now that this has landed, you can add "3.15" to a GitHub Actions testing matrix to run tests against the new Python 3.15.0 release.

# 11:58 pm / github, python, github-actions, chatgpt

Deno is joining Cloudflare (via) The Deno team released the first version of celld back in August - their open source implementation of the Durable Objects pattern from Cloudflare Workers.

Today, Cloudflare are acquiring Deno outright, with the goal of building on celld to "make workerd self-hosting a first-class supported way to build and run apps using the Workers programming model" (see the Cloudflare blog.)

The bad news is that Deno itself will not be maintained by Cloudflare beyond the next year:

We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime. Deno will remain open source, and we welcome others who want to continue its development.

Deno (and Node.js) creator Ryan Dahl explained that decision in a comment on Hacker News:

It's a joint decision and I agree with it. I'm most invested in its success and have put the most work into it - and I no longer think it's where I can do the most important work. There are some good ideas in Deno and it's well engineered - but it ultimately is not solving big problems. It has been sucked into the gravity well of node compatibility, which forces it to behave exactly as Node does. Why reimplement Node? It works. Marginal performance or UX or security benefits are not enough.

I'm interested in building powerful new abstractions. celld has been working remarkably well, depending only on object storage for coordination and persistence. It is not just a slightly different API to interact with the file system or network - it's an entirely new model for server development.

My favorite feature of Deno has long been the permissions system, where you can run a Deno script and specify exactly which files and folders it can read and write to, and which network hosts it can access.

Node.js has a similar permissions model these days, added in Node v20.0.0 in April 2023 and declared stable in Node v22.13.0 in January 2025. They don't yet support allow-listing specific network hosts though - networking is either on or off.

# 10:48 pm / cloudfront, javascript, nodejs, ryan-dahl, sandboxing, deno

Anti-Patterns in Software Blogging (via) Some excellent writing advice from Michael Lynch. Michael warns against "meandering intros", misjudging your reader's existing knowledge, assuming they'll read your previous posts, and excessive formality.

He also warns against overreliance on links as an excuse not to explain terminology. This one hurt! I do this all the time, but I have a nagging suspicion that almost nobody ever clicks on them.

(In a Lobste.rs comment Michael clarifies that "My rule of thumb is that my article should still make sense to the reader even if they don't click any links". That works for me.)

This point about using your own voice is crucial:

Beginner software bloggers suffer from a mass delusion that you have to write in a stiff, overly formal way for people to take you seriously [...]

Just write the way you talk.

With so many developers delegating their writing to AI, software blogging is becoming bland and homogenous. Readers are hungry for writing with personality.

# 2:53 pm / blogging, writing, michael-lynch

OpenAI “rogue” agent activities found on Wikimedia projects. Given how tempting a target wikis are for rogue agent swarms, it's not a huge surprise that Wikipedia found evidence of that activity once they went looking:

The Wikimedia Foundation conducted its own investigation to see whether Wikimedia websites had been similarly affected by AI agents, focusing on those operated by OpenAI. We can confirm that we have discovered some activity by these “rogue” OpenAI agents on Wikimedia platforms. The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic, which are described more below.

They found evidence of agents editing sandbox pages, trying to use pieces of infrastructure such as Etherpad to help proxy content from elsewhere, and saw widespread crawling and "hundreds of thousands of data queries" to their Wikidata Query Service.

My best guess is that most of this was a similar (or the same) swarm of agents as those that defaced that German wiki while training for research tasks.

The Wikipedia sandbox wiki edits appear to have started on May 12th, and the initial test edits to the UseModWiki Sandbox page reported by that incident started on May 11th.

# 12:16 am / wikimedia, wikipedia, wikis, ai, generative-ai, llms, ai-ethics, accidental-cyberattacks

Introducing Mistral Large 4: Le chonk (via) Mistral are back in the game. Today they're releasing a preview of Mistral Large 4, a 1 trillion parameter, 49 billion active parameter model trained on their own cluster of 3,800 NVIDIA Grace Blackwell GPUs.

The preview is available via their API. They promise to release the open weights model at the "end of this month".

The model only supports two reasoning levels - "none" and "high" - via the Mistral API. Here are both pelicans - the "high" one looks better, though surprisingly it only used 2,717 output tokens compared to "none" which used 3,275:

On Artificial Analysis it scores 38, just behind DeepSeek 4.1 Flash, which is a 552B model. It's a huge improvement on last December's Mistral Large 3, which drew this terrible pelican and scored 9 on AA.

It's certainly not a Fable-class model, but it's great to see Mistral put out a model that's back to being maybe about 6 months behind the frontier.

# 8:18 pm / ai, generative-ai, llms, mistral, pelican-riding-a-bicycle, llm-release