Simon Willison used Claude Code running Opus 4.8 to port Moebius 0.2B, a small image inpainting model that fills in regions a user marks for removal, from its original PyTorch and CUDA requirements to run entirely in the browser on WebGPU (Simon Willison). The work involved converting the model to ONNX, publishing 1.24GB of weights to Hugging Face, caching roughly 1.3GB of model files through the CacheStorage API, and deploying the frontend on GitHub Pages, with the result tested in Chrome, Firefox and Safari. Willison reports reaching a working demo without hand-writing the code, leaving implementation and debugging to the agent (Simon Willison).
He also flagged research from Charles Ye, Jasmine Cui and Dylan Hadfield-Menell arguing that prompt injection is better understood as role confusion: models lean on formatting style rather than content to decide which text to trust, so an attacker can imitate the model’s expected internal thinking patterns to get through (Simon Willison). Destyling the malicious text, meaning stripping and reformatting it, cut attack success from 61 percent to 10 percent on the authors’ dataset. The researchers argue that unless models gain genuine role perception, injection defense will remain a whack-a-mole problem (Simon Willison).