Using AI to Detect Bluesky Reply Bots: Simon Willison's Detection Tool
Simon Willison used AI vibe coding to build a Bluesky bot detector — fighting AI misuse with AI.
Developer Simon Willison, fed up with bot harassment, used Claude Opus and "vibe coding" to rapidly build a Bluesky reply bot detection tool. Leveraging Bluesky's open free API, the tool identifies suspected bot accounts based on abnormal response speed, lack of original content, and question-baiting behavior. The case highlights AI's dual role in today's social ecosystem: generative AI is being widely abused to produce automated spam, while the same technology enables individual developers to build defensive tools with a low barrier to entry. Bluesky's open API strategy makes community-driven detection and governance possible — a concrete example of how open platforms can respond to automated abuse.
Reply Bots Are Spreading to Bluesky
Automated reply bots have long been a persistent problem on social platforms. Prominent developer Simon Willison openly admits that as someone with a large following, anything he posts on Twitter draws swarms of bot replies — every post buried under meaningless automated comments.
Now, these bots are migrating to Bluesky. The platform may have changed, but the nature of bot harassment hasn't. The key difference is that Bluesky still maintains a free, accessible API. The absence of an API doesn't stop bots from operating, but it does make investigating and identifying them significantly harder. That accessibility is precisely what makes building detection tools possible.
Bluesky is a decentralized social platform initially championed by Twitter co-founder Jack Dorsey and now operated independently by Bluesky Social, PBC, built on the AT Protocol (Authenticated Transfer Protocol). Unlike Twitter/X, Bluesky was designed from the ground up with openness as a core principle: its API remains freely available to the public, allowing developers to read public post data, user information, and interaction records without a paid subscription. When Twitter moved to a paid API model in 2023, it forced out a large number of third-party developers and researchers, crippling independent oversight and ecosystem tooling. Bluesky's open API approach is widely seen as a counterpoint to Twitter's closed-off trajectory — though it equally means automated bots can access the platform at low cost.
A Detection Tool Built Through AI "Vibe Coding"
Simon Willison used Claude Opus 3.5 and a "vibe coding" approach to rapidly build this Bluesky reply bot detection tool. Vibe coding refers to a development mode where the developer describes requirements in natural language and a large language model generates working code directly — the full contribution history is publicly available in his GitHub PR.
This case is particularly illustrative: it demonstrates how AI-assisted programming is lowering the barrier for building small utilities. A project that would otherwise require familiarity with the Bluesky API and custom data analysis logic can now be shaped quickly through conversation with a model. For practical tools built to scratch a personal itch, this development paradigm offers a particularly compelling efficiency advantage.
How the Tool Determines Whether an Account Is a Bot
The tool's core function is to examine any Bluesky profile and look for signals suggesting it might be a reply bot. The detection dimensions it uses include:
Abnormal Response Speed
If an account consistently replies within seconds of someone else posting, that time pattern — far beyond human reaction speed — is a strong signal of automated behavior.
Replies Only, Never Original Content
The tool flags accounts that never post original content of their own (including images or links), but continuously reply to posts from high-follower accounts. This "parasitic" activity pattern is a hallmark of reply bots — their goal is typically to drive traffic or gain attention by piggybacking on popular accounts' exposure.
Question Mark Detection
Simon Willison specifically built in detection for question marks. He candidly notes that he finds it especially irritating when bots throw out questions, tricking real people into wasting time answering something no actual human asked. This slightly personal feature reflects the real frustration of users on the receiving end of bot harassment.
The Dual Nature of AI, Visible Through This Tool
This small tool carries significance beyond its immediate function. It simultaneously illustrates both sides of AI within the social ecosystem: one side is AI being misused (the tool is explicitly tagged with ai-misuse), with generative content and automated bots degrading the quality of conversation on social platforms; the other side is AI becoming a weapon against that very misuse, as developers use large language models to rapidly build defensive tools.
Bluesky's decision to keep its API open demonstrates its value here. Openness treats bots and legitimate users the same — but it also empowers the community and independent developers to build transparent detection and governance tools, rather than relying entirely on the platform itself. By contrast, platforms with closed APIs make third-party oversight and investigation even harder. This offers a concrete, small-scale case study for the broader question of how open platforms can respond to automated abuse.
Background
"Vibe Coding" is a concept introduced by AI researcher Andrej Karpathy in early 2025. It describes a style of programming heavily reliant on large language models: rather than deeply understanding every line of implementation, the developer expresses intent through natural language and lets the model iteratively generate and revise code, with the developer simply verifying whether the output meets expectations. The fundamental difference from traditional programming lies in a shift in cognitive focus — from "how to write code" to "how to describe requirements and validate outputs." This dramatically lowers the barrier for building functional prototypes, especially for scenarios with clear goals but limited experience with a specific technology stack. It's worth noting that vibe coding's reliability and security in production environments remain contested — critics point out it can produce "black box code" that developers are unable to fully audit.
Related articles
Random Pruning of the DPO Computation Graph: 1.4x Training Speedup and Lower Peak Memory
DPO training too slow and memory-hungry? This paper proposes a random pruning framework for the DPO computation graph, sampling independently across position, sequence, and branch dimensions; branch pruning achieves a 1.426x step-time speedup and cuts training time by about 30%, with in-depth attribution of memory and time gains.
Why Does JEPA Underperform MLM in Longitudinal EHR Representation Learning?
New study compares JEPA and MLM for longitudinal EHR representation learning on MIMIC-IV: three JEPA variants train stably without collapse but underperform MLM; target size, not heterogeneity, drives prediction error.
Transfer Learning + Visible Light Communication: A New Approach to Energy-Efficient Indoor Positioning
A study proposes a transfer learning-based visible light communication indoor positioning method, achieving 47% accuracy improvement on the BOSCH factory dataset, 67.5% model efficiency under high noise, and introducing the ME composite metric for energy-efficient positioning in energy-constrained industrial IoT scenarios.