AI, ML, and LLMs Explained: How they Work and How attackers break them

Somewhere right now, an AI agent is booking a flight, a chatbot is writing your marketing copy, and a hacker is trying to convince both of them that a picture of a stop sign is actually a picture of a banana.

Welcome to 2026. Let's break down how AI actually works — and why the same intelligence that makes it powerful is exactly what makes it hackable.

Part 1: The Family Tree Nobody Explains Properly

People throw around "AI," "machine learning," and "deep learning" like they're interchangeable. They're not. Think of it as Russian nesting dolls:

Artificial Intelligence (AI) is the biggest doll — the entire field devoted to making machines mimic intelligent behavior. It's the umbrella.

Machine Learning (ML) sits inside it. This is the subset where systems don't get explicitly programmed with rules — instead, they learn by recognizing patterns in data.

Deep Learning (DL) is the smallest, densest doll inside that. It's ML that runs on neural networks — specifically built from units called perceptrons, loosely modeled on how neurons fire in the human brain.

And then there's the doll everyone's obsessed with right now: Large Language Models (LLMs). These are a specific breed of deep learning model built on transformer architecture — the blueprint that made ChatGPT, Gemini, and Claude possible in the first place.

So when someone says "AI wrote my essay," what actually happened is: a transformer-based deep learning model, trained via machine learning, operating inside the broader field of AI, generated your essay. Same event, four different layers of doll.

Part 2: The Three Things Every AI Model Needs to Exist

Strip away the hype and every AI system — from a spam filter to a self-driving car — needs exactly three ingredients:

1. Data — the raw material it learns from
2. Algorithms — the recipe for learning patterns in that data
3. Computation power — the GPUs and CPUs doing the actual grinding

No data, nothing to learn from. No algorithm, no way to learn. No compute, nowhere for the learning to happen. Simple as that.

Part 3: How AI Actually Learns (Three Flavors)

• Supervised Learning — the model studies labeled examples ("this is a cat," "this is not a cat") to learn classification or regression tasks. It's learning with an answer key.
• Unsupervised Learning — no labels, no answer key. The model just stares at raw data and finds hidden structure through clustering or dimensionality reduction. It's pattern-hunting in the dark.
• Reinforcement Learning — the model learns by doing, getting rewarded for good moves and punished for bad ones. This is how game-playing AIs and robots learn — trial, error, repeat, improve.

Part 4: Predictive, Generative, Agentic — The Three Faces of Modern AI

• Predictive AI looks backward to guess forward — historical patterns used to predict stock prices, recommend your next movie, or flag a network intrusion before it happens.
• Generative AI is the one everyone's talking about — ChatGPT, Gemini, and friends. Here's the twist: it doesn't actually "create" anything. Under the hood, it's just predicting the next token — the next word or character — over and over, at superhuman speed. The magic is an illusion built from really good next-word guessing.
• Agentic AI is the newest and most dangerous-in-a-good-way evolution. The LLM becomes the brain, and it's handed hands — access to external tools like calendars, databases, or booking systems — so it can actually go do things autonomously. Book your flight. Check your server logs. Send that email.

And that's exactly where the story turns from "cool tech demo" to "security nightmare."

Part 5: The Attack Surface — Where AI Actually Breaks

Give something a brain and hands, and suddenly it has a lot more ways to be exploited than a static piece of software ever did. Security researchers break the AI attack surface into five layers:

1. Prompt Risk

This is the front door, and it's rarely locked. Prompt injection attacks try to override a model's system instructions — tricking it into leaking sensitive data or bypassing its own safety filters, just by phrasing a request the right (wrong) way.

2. Data Risk

Data poisoning happens earlier, during training. An attacker corrupts the data a model learns from, quietly teaching it wrong patterns or planting bias that surfaces later, when it's too late to easily undo.

3. Model Risk

This covers theft of the model itself, and evasion attacks — adversarial inputs specifically engineered to fool an already-deployed model into spitting out the wrong answer.

4. Infrastructure Risk

The unglamorous layer that breaks everything else. Vulnerabilities in the GPUs, APIs, or CI/CD pipelines used to build and ship the model can lead to full system-wide compromise. Doesn't matter how smart your model is if the pipeline shipping it is wide open.

5. Excessive Agency

This is the one unique to agentic AI. Once an agent has real access — to a credit card, a database, an email account — a compromised or manipulated agent can misuse that access if it isn't tightly constrained. Hands are only as trustworthy as the leash on them.

Part 6: How the Attacks Actually Work

Poisoning (Training Phase) Attackers hijack the learning process itself. In a label-flipping attack, a malicious file gets relabeled as "normal" during training — so the model literally learns to ignore the threat. In a trigger attack, something small and specific — like a tiny white square placed in the corner of an image — is planted so it forces the model to misclassify anything containing that trigger, on demand.

Evasion (Deployment Phase) Here, the model is already live, already trained, already trusted — and the attacker feeds it carefully crafted adversarial inputs designed to fool it in real time.

Prompt Injection — Direct vs. Indirect

• Direct: someone just types the malicious instruction straight into the chatbox.
• Indirect: the model processes external content — a webpage, an email, a document — that has hidden malicious instructions buried inside it. The model never sees a "user" typing anything sketchy; it just reads a poisoned webpage and follows orders anyway.

That second one is the sleeper threat of agentic AI. If your AI agent reads emails or browses the web to complete a task, it can be attacked by content it merely looks at — no direct interaction with the attacker required.

Part 7: The Playbooks Security Teams Actually Use

This isn't uncharted territory — it's becoming a mature discipline with its own reference frameworks:

• OWASP Machine Learning Top 10
• OWASP LLM Top 10
• MITRE ATLAS
• MAESTRO (built specifically for agentic AI)

If you're building or securing AI systems, these frameworks are the closest thing the industry has to a shared map of the minefield.

The Takeaway

We handed AI a brain (LLMs), then gave it hands (agentic tools), and now we're racing to figure out how to keep those hands out of trouble. Every layer that makes AI more capable — more autonomous, more connected, more "intelligent" — is also a new layer of attack surface.

The models aren't magic. They're prediction engines wearing a very convincing costume. And like anything powerful enough to act on our behalf, the real question isn't what can it do — it's who else can tell it what to do.