LLM Predictions for 2026
Reasoning models have made LLM-generated code undeniably good, and 2026 will bring both a major security incident from coding agents and the resolution of the sandboxing problem.
Summary
Simon Willison shares predictions across three time horizons on the Oxide and Friends podcast. His core argument: reinforcement learning has transformed code generation to the point where his own hand-coding has dropped to single digits. The near-term brings both opportunity (sandboxing solutions, browser development via AI) and risk (a significant cybersecurity incident from coding agents).
Key Predictions
One Year (2026)
- LLM code quality becomes undeniable - Reasoning models trained with reinforcement learning have dramatically improved code generation. The debate over whether LLMs write good code will end.
- Sandboxing finally gets solved - Containers and WebAssembly will enable safer execution of third-party code. The missing piece is better UX.
- A major security incident from coding agents - References the "Normalization of Deviance" pattern: unsafe practices continue until catastrophic failure. Expect a significant breach.
- Kakapo breeding success - A fun non-tech prediction: New Zealand's endangered parrot will have an outstanding breeding season due to rimu fruit availability.
Three Years
- Jevons Paradox resolution - The software industry will learn whether AI automation devalues engineering work or increases demand proportionally.
- AI-built web browser - A new browser built primarily with AI-assisted coding will ship without controversy. Existing conformance tests provide clear success metrics.
Six Years
- End of manual coding as paid work - Paid code-typing positions become obsolete, though software engineering careers evolve rather than disappear.
Takeaways
Willison frames this moment as pivotal uncertainty. The technology has clearly crossed a capability threshold, but the consequences remain unclear. Will increased productivity expand the software market (Jevons Paradox) or contract it? The security incident prediction stands out as the most concrete near-term concern - we're running untrusted code with inadequate sandboxing, and that bill will come due.