Skip to content
corpus.blog
Sign in Claim your blog
Record · simonwillison.net

The Dual LLM pattern for building AI assistants that can resist prompt injection

Simon Willison · 12 min read

A post on simonwillison.net is cited by 15 distinct blogs to date (corpus.blog, measured 11 October 2026).

A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.

Read at simonwillison.net (opens in a new tab) Wayback capture (opens in a new tab)

15blogs citing

Citing blogs and links by period
Period Blogs Links
All time1517
Last 90 days22
Last 30 days22
Last 7 days11
Figures for this page
First cited1 May 2023
Latest citation10 Oct 2026
Words blogs link it with5
Linked with its own title2 of 15 blogs
External links5
Length2,564
New citing blogs a weeksince May 2023
New citing blogs a week, since May 2023: 180 weeks, peak 1 a week, latest week 1

1 this week (still settling) · peak 1

Show as table
New citing blogs a week, week by week
Week of Value
1 May 20231
8 May 20230
15 May 20230
22 May 20230
29 May 20230
5 Jun 20230
12 Jun 20230
19 Jun 20230
26 Jun 20230
3 Jul 20230
10 Jul 20230
17 Jul 20231
24 Jul 20230
31 Jul 20230
7 Aug 20230
14 Aug 20230
21 Aug 20230
28 Aug 20230
4 Sept 20230
11 Sept 20230
18 Sept 20230
25 Sept 20230
2 Oct 20230
9 Oct 20230
16 Oct 20230
23 Oct 20230
30 Oct 20230
6 Nov 20230
13 Nov 20230
20 Nov 20230
27 Nov 20230
4 Dec 20231
11 Dec 20230
18 Dec 20230
25 Dec 20230
1 Jan 20240
8 Jan 20240
15 Jan 20240
22 Jan 20240
29 Jan 20240
5 Feb 20240
12 Feb 20240
19 Feb 20240
26 Feb 20240
4 Mar 20240
11 Mar 20240
18 Mar 20240
25 Mar 20240
1 Apr 20240
8 Apr 20240
15 Apr 20240
22 Apr 20240
29 Apr 20240
6 May 20240
13 May 20240
20 May 20240
27 May 20240
3 Jun 20240
10 Jun 20240
17 Jun 20240
24 Jun 20240
1 Jul 20240
8 Jul 20240
15 Jul 20241
22 Jul 20240
29 Jul 20240
5 Aug 20240
12 Aug 20240
19 Aug 20240
26 Aug 20240
2 Sept 20240
9 Sept 20240
16 Sept 20240
23 Sept 20240
30 Sept 20240
7 Oct 20240
14 Oct 20240
21 Oct 20240
28 Oct 20240
4 Nov 20240
11 Nov 20240
18 Nov 20240
25 Nov 20240
2 Dec 20240
9 Dec 20240
16 Dec 20240
23 Dec 20240
30 Dec 20240
6 Jan 20250
13 Jan 20250
20 Jan 20250
27 Jan 20250
3 Feb 20250
10 Feb 20250
17 Feb 20250
24 Feb 20250
3 Mar 20250
10 Mar 20250
17 Mar 20250
24 Mar 20250
31 Mar 20250
7 Apr 20250
14 Apr 20250
21 Apr 20250
28 Apr 20250
5 May 20250
12 May 20250
19 May 20250
26 May 20250
2 Jun 20250
9 Jun 20250
16 Jun 20251
23 Jun 20250
30 Jun 20250
7 Jul 20250
14 Jul 20250
21 Jul 20250
28 Jul 20250
4 Aug 20250
11 Aug 20250
18 Aug 20250
25 Aug 20251
1 Sept 20250
8 Sept 20250
15 Sept 20250
22 Sept 20250
29 Sept 20250
6 Oct 20250
13 Oct 20250
20 Oct 20250
27 Oct 20250
3 Nov 20250
10 Nov 20250
17 Nov 20250
24 Nov 20251
1 Dec 20250
8 Dec 20251
15 Dec 20250
22 Dec 20250
29 Dec 20250
5 Jan 20260
12 Jan 20260
19 Jan 20260
26 Jan 20260
2 Feb 20260
9 Feb 20260
16 Feb 20260
23 Feb 20260
2 Mar 20260
9 Mar 20260
16 Mar 20260
23 Mar 20260
30 Mar 20260
6 Apr 20260
13 Apr 20261
20 Apr 20260
27 Apr 20260
4 May 20260
11 May 20261
18 May 20260
25 May 20260
1 Jun 20260
8 Jun 20260
15 Jun 20261
22 Jun 20260
29 Jun 20260
6 Jul 20261
13 Jul 20260
20 Jul 20260
27 Jul 20260
3 Aug 20260
10 Aug 20260
17 Aug 20260
24 Aug 20260
31 Aug 20260
7 Sept 20260
14 Sept 20260
21 Sept 20260
28 Sept 20261 (still settling)
5 Oct 20261 (still settling)

Shape: evergreen. Half of its 14 citing blogs had cited it after 943 days; 79% first cited it more than a year on.

Each blog counts once, in the week of its first citation. 1 blog has no dated post that cites this page: counted in the tally, not here. A blog added to the index recently can bring old first citations in at once.

Who cited it

Cited by 15 blogs across 2 subjects: technology 9, books and writing 1, unclassified 5.

Words blogs link it with

The words blogs link this page with, by how many different blogs use them.

  • dual llm2 blogs
  • dual-llm pattern2 blogs
  • the dual llm pattern for building ai assistants that can resist prompt injection2 blogs
  • simon willison: dual llm pattern1 blog
  • dual llm architecture1 blog

Cited by 15 blogs in 17 posts

One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.

Blog
Newest citing post
Date
andrewbaker.ninja1 post
Prompt Injection and AI Agent Security: Why a Language Model Is Not a Security Boundary Read at andrewbaker.ninja (opens in a new tab)
10 Oct 2026
LessWrong1 post
Low-Background Minds

linked as “dual-LLM pattern”

Read at lesswrong.com (opens in a new tab)
3 Oct 2026
juppytt.github.io1 post
DualView: A Safe View for the Agent, the Original View for Humans

linked as “Willison”

Read at juppytt.github.io (opens in a new tab)
7 Jul 2026
commandline.microsoft.com1 post
Information-flow control: Moving toward secure, autonomous agents

linked as “the Dual LLM pattern”

Read at commandline.microsoft.com (opens in a new tab)
16 Jun 2026
Sophos News1 post
Operating inside the lethal trifecta: Blast radius reduction in AI agent deployments

linked as “Dual LLM”

Read at sophos.com (opens in a new tab)
12 May 2026
ret2libc.com1 post
The Prompt Injection Defence Landscape

linked as “Dual LLM”

Read at ret2libc.com (opens in a new tab)
15 Apr 2026
Google Security Blog1 post
Architecting Security for Agentic Capabilities in Chrome

linked as “dual-LLM pattern”

Read at security.googleblog.com (opens in a new tab)
8 Dec 2025
{ Mario Zechner }1 post
What I learned building an opinionated and minimal coding agent

linked as “written extensively”

Read at mariozechner.at (opens in a new tab)
30 Nov 2025
Digitaliziran | Digitaliziran1 post
The AI Security Crisis You Can't Ignore: Why Simon Willison's 'Lethal Trifecta' Demands Immediate Action

linked as “mitigation strategies exist”

Read at digitaliziran.si (opens in a new tab)
27 Aug 2025
simonw.substack.com1 post
The lethal trifecta for AI agents

linked as “The Dual LLM pattern for building AI assistants that can resist prompt injection”

Read at simonw.substack.com (opens in a new tab)
17 Jun 2025
rwblickhan.org1 post
Did you know stone fruit like peaches and plums are coming into season this month? (rwblog S6E5)

linked as “dual LLM pattern”

Read at rwblickhan.org (opens in a new tab)
17 Jul 2024
dylandavis.net2 posts
Securing the New Era of AI-Driven Operating Systems: A Novice’s Tale

linked as “dual LLM architecture”

Read at dylandavis.net (opens in a new tab)
16 Dec 2023
1 other post
GenAI’s Shift: From Cyber Villain to LLM Protector

linked as “dual LLM model”

Read at dylandavis.net (opens in a new tab)
10 Dec 2023
shaddy.dev1 post
Prodding Wise Wizards – Prompt Injection in Gandalf's Game

linked as “models”

Read at shaddy.dev (opens in a new tab)
20 Jul 2023
wersdoerfer.de1 post
Weeknotes 2023-05-01

linked as “The Dual LLM pattern for building AI assistants that can resist prompt injection”

Read at wersdoerfer.de (opens in a new tab)
1 May 2023
genai.owasp.org2 posts
LLM06:2025 Excessive Agency

linked as “Simon Willison: Dual LLM Pattern”

Read at genai.owasp.org (opens in a new tab)
—
1 other post
LLM06:2025 Excessive Agency

linked as “Simon Willison: Dual LLM Pattern”

Read at genai.owasp.org (opens in a new tab)
—

Links from this post

Link
Host
Elsewhere on simonwillison.net (6)

Something wrong here? Report a problem