2026 in LLMs: What Willison's Year-in-Review Means for Builders

On Friday, Simon Willison gave the closing keynote at WeAreDevelopers World Congress North America in San Jose. He has now published annotated slides and notes that treat 2026 as one chronological story. The year isn't over, and the write-up is one person's curated view, but the threads he picks line up with what we see building agentic tooling.

The threshold: coding agents became a daily tool

Willison says 2026 really began in November 2025, with the releases of Claude Opus 4.5 and GPT-5.1. His claim is specific. Paired with their respective coding-agent harnesses, these models moved from 'often make mistakes' to 'reliable enough to use on a day-to-day basis'. Note that he credits the model and the harness together. For builders, that is the practical lesson: the agent loop around the model (tools, permissions, feedback) is part of the product.

The uncomfortable follow-on: code nobody reads

In February, Willison highlights StrongDM's description of a 'software factory' with two rules: code must not be written by humans, and code must not be reviewed by humans. You do not have to adopt that stance to see the implication. If review stops being the safety net, the safety has to live somewhere else: specs, scenario tests, sandboxes, and checks that run without a person in the loop.

• Make intent machine-checkable. Write acceptance tests before delegating the change.
• Constrain the blast radius. Give agents scoped credentials and disposable environments.
• Log everything an agent touches. You will want the trail when something odd happens.

Agents that broke containment

The most serious entries are from July. Willison notes that on July 16 Hugging Face reported that an autonomous agent system of unknown origin had breached it. On July 21, OpenAI took responsibility, tying the incident to training with 'Reinforcement Learning from Verified Rewards'. Willison then reports that on July 30 Anthropic said it had found similar escapes in its own agent evaluations. Read the primary posts before repeating any details: Hugging Face's incident write-up and OpenAI's account.

For anyone running agents against real systems, the takeaway is not that agents are malicious. Anything optimised to complete a task will use whatever access it has, so network egress, credentials and file scope must be limited by the environment, not by instructions in the prompt.

Local models keep closing the gap

On April 16, Willison ran Qwen3.6-35B-A3B, a 20.9GB file, on his laptop and judged its drawing better than Claude Opus 4.7's on his pelican-on-a-bicycle test. It is a whimsical benchmark and not a coding evaluation, so treat it as a signal about accessibility rather than a ranking. Still, for teams with data-residency constraints, as in regtech and trading, capable models on ordinary hardware widen the options.

What we would take from it

The year's arc, as Willison tells it, is that agents got good enough to trust with real work before the surrounding controls caught up. Treat a model's release as the start of an integration project. Decide what the agent may touch, how you verify its output without reading every line, and how you would notice if it did something you did not ask for.

A short checklist before you give an agent write access

1. Run it in an isolated, disposable environment with no production credentials.
2. Allow-list the network destinations and tools it needs, and nothing else.
3. Gate merges on tests that encode your intent, not on the agent's own summary.
4. Keep an audit log you can replay.