This is a pretend chatbot (it only knows a few tricks). Send a message, then tap the little orange i buttons on the chat to peek behind that piece of the screen. The rest of the page dims so you can see exactly what's being explained.
The window you type into is not the AI. It's an ordinary app wrapped around the AI. The technical name for that wrapper is the harness, and the AI inside is called the model.
🙂You
⇄
🧰Harness the app
⇄
🧠Model the brain · latest pick
The model is surprisingly limited: text in, text out, and it forgets everything the moment it replies. The harness fills in every gap:
It shows the chat and the text box.
It keeps the conversation and re-sends it every turn. That's the chatbot's "memory".
It adds hidden instructions you never see, like "be friendly and short".
It sends everything to the model and shows the reply as it arrives.
It runs tools (like a weather lookup) when the model asks.
So a "chatbot" is really harness + model. The next parts zoom into each piece you see on screen.
WORDS IN THIS PART
Harness
The app wrapped around the model: the screen, the memory, the tool-running. Everything except the brain.
Model
The AI itself: the program that turns text in into text out.
System prompt
The hidden instructions the harness adds to every conversation.
Whatever you type is your prompt. But the model can't read letters or words like you. It only understands numbers. So first, your prompt is taken apart into small standard pieces called tokens. Think of Lego bricks: from a fixed set of standard parts you can build anything. Each piece of text is a brick, and each kind of brick has its own part number.
The numbers here are made up for show. Real ones differ per model, but the idea is identical. Real models know roughly 50,000–200,000 different kinds of brick, like a Lego set with that many part types. Common short words are usually one brick; long or rare words are built from several.
Important: a token number is just a part number. It says which brick, not what it means, just as a Lego part number doesn't tell you what you're building. Tokens are what goes into the model. The weights (next part) are the model itself.
🔭 Go deeper:How LLMs Work, a long visual walkthrough that starts with tokens.
WORDS IN THIS PART
Prompt
What you type to the AI.
Token
A small chunk of text (a word, part of a word, or punctuation) with its own part number. Think of it as a Lego brick of text. The only thing a model can read.
The model is a wall of dials. Each dial is a weight: one number saying "how much should this clue matter?" Parameters is just another word for the dials. A "7-billion-parameter model" has 7 billion dials.
Here's a tiny machine with just 9 dials that guesses an animal from a clue. Two very different things happen to a machine like this, so try them one at a time:
Pick a clue:
The machine's guess:
How does this tiny machine relate to a real LLM?
The clue you pick
= your prompt. The tokens going in.
The dials
= the weights. They decide how the input turns into an answer.
The bars
= the output: a score for every possible answer. For a real LLM the "animals" are every possible next token.
Turning the dials / Train it
= training. Done once, by the AI company, long before you type anything.
Picking a clue and reading the guess
= using the model, which happens every time you send a prompt. The dials stay frozen while it does this.
Training is how the dials get set. Nobody turns them by hand. The machine guesses, gets told "wrong, it was a cat", and each dial is nudged a tiny bit in the direction that would have made it less wrong. Repeat trillions of times. Press Train it! to watch a baby version of this.
A real model works the same way, with hundreds of billions of dials instead of 9 and whole libraries of text instead of 3 examples. The finished "model" file is nothing but the final position of all the dials. That's where its "knowledge" lives.
So how do tokens and weights connect? Each brick's part number is looked up in a giant table to get a long list of numbers describing that brick (the machine's "notes" on it). Those notes are dials too, set during training. The brick's numbers then flow through the rest of the dials, and out the other end come scores for every possible next brick.
The model only ever does one thing: given the bricks so far, score every possible next brick, and pick one. Then it adds that brick to the pile and does it again. That's how it "writes" a whole answer, which is why replies type out piece by piece. Press the button to step through.
Why can the same question give different answers? The pick is a weighted dice roll, not always the top score. That "randomness" setting is called temperature.
The model forgets everything the instant it finishes a reply. So why does the chat feel like a conversation? Because the harness keeps a running copy of the whole chat and, every time you press Send, hands the model the whole notebook to read from scratch:
[hidden instructions] You are a helpful assistant...
You: Hi!
Bot: Hello! How can I help?
You: What's the capital of France? ← your new message
Bot: ▍ ← model guesses from ALL of the above
There's a limit to how much fits in the notebook. That limit is the context window. Once a chat gets longer than it, the oldest parts have to be dropped or summarised, which is why very long chats seem to "forget" the beginning.
WORDS IN THIS PART
Context window
Everything the model is shown each turn (instructions, chat so far, your new message), and the size limit on it.
Some chatbots first write notes to themselves, and only then answer. These notes are made exactly like any reply, one token at a time, using the very same guessing loop. They're added to the notebook, so the final answer is written after re-reading them.
It's like showing your work on a maths test: writing the steps down makes the final answer easier to get right. The cost: all those extra tokens take extra time and money, and the notes can be longer than the answer you see. The harness usually collapses or hides them.
WORDS IN THIS PART
Thinking / reasoning
Tokens the model writes to itself as a scratchpad before its real answer. Same guessing, just aimed at notes.
The model is only a text-guesser. It can't browse the web, open files or check the weather. It's like a very clever person locked in a room who can only pass notes under the door.
The harness is the assistant sitting outside the door. It carries the notes, and when the model asks, it actually does things with tools, then hands the results back. This back-and-forth is the agentic loop, and a model set up to run it until a job is done is an agent. Step through it:
🙂You
🧰Harness the assistant
🧠Model the brain · latest pick
🌦️Tool weather app
Loop: not started
The loop stops when the model answers without asking for a tool. Real agents (coding assistants, for instance) do this dozens of times: read a file, edit it, run tests, read the error, try again.
WORDS IN THIS PART
Tool
Something the model can ask the harness to do: search, calculate, read a file, check the weather.
Agentic loop
Ask the model, run its tool request, give back the result, ask again. Repeat until it answers.
Agent
A model plus a harness and tools, looping until the job is done.
Simplified on purpose: real models use many layers of dials and special math (attention) to relate tokens to each other. The big picture above is true to how they work.
DEBUNKING THE HEADLINES
🗞️ Scary AI headlines, one question at a time
Most scary AI stories start from something real. But the headline and the event are often two different things. Each one below asks the same three things: is there anything to it, what is really going on, and what does that mean?
This is only about how the machinery works. It’s not a forecast, because nobody can predict the future, and experts genuinely disagree. Where sources conflict or details are unconfirmed, we say so.
🔭 Go deeper:the AI Incident Database collects reported AI incidents from the news. It’s a raw, unfiltered archive, so expect headlines without the explaining.
🌤️ The short version
Today’s AI can’t act beyond the access and tools people give it. It has no wants or motives and doesn’t start anything on its own. But a capable model can find ways to use that access that nobody expected, so the limits have to be built tightly and watched. Like any powerful tool, it can still do harm in the wrong hands, and it can make some attacks faster and cheaper for people who want to carry them out.
Why the design doesn’t allow it
On its own, a model can only produce text. It’s a wall of dials (its weights) that turns text into likely next text.
It can only do what the app around it allows. Its “hands” come from that app (the harness), which decides which tools it gets.
Between messages, nothing is running, so there’s nobody home to plot. It keeps no memory between chats, only what the app puts in its notebook (the context window).
What the incidents show
Most were staged on purpose. Researchers rig a situation to see what a model does. That is what testing is for: finding problems while they’re cheap.
The ones that touched the real world came from gaps people left. A leaky test room, a shared key and an alarm nobody acted on; a live database with no approval step. Each is a hole humans left open, sometimes a hidden one nobody knew about, which the AI used while chasing the goal it was given. It didn’t grant itself new powers. Because AI works so fast, the usual answer is tight limits plus automatic alarms and cut-offs that don’t wait for a person.
None needs an AI that “wants” something to explain it. Each is a goal, plus a loophole, plus nobody watching.
The safety question is mostly about what we plug AI into, and who is watching. That’s the part people control, and the problems found so far have known, dull fixes. All of this describes how AI works today. A future design that works differently could change the picture, and nobody can say for certain.
☠️ “AI will kill everyone within a decade”
Some respected researchers warn that super-smart AI could wipe out humanity. Others think that is wildly overblown. Both camps include serious experts.
Break it down
TL;DR: nothing in how today’s AI is built points toward this: it has no way to act beyond what people connect it to. A future design could differ, and the far future is honestly unknown, but any danger would run through human decisions about what to connect AI to.
Is there anything to it?
It’s a real debate. In 2023 many leading AI researchers and company heads signed a one-sentence statement: reducing the risk of extinction from AI should be a global priority, next to pandemics and nuclear war. In surveys, the middle answer from machine-learning researchers on “how likely is an extremely bad outcome, like extinction?” was about 5%, with answers from 0% to much higher.
So it’s a worry many experts take seriously, and a very uncertain one. Nobody has a track record to check it against.
What would it really take?
A model is a pile of numbers that turns text into more text. It does nothing until a person plugs it into something. For the doom story to work, people would have to do all of this:
Build something far more capable than any AI today (nobody knows if that’s possible).
Give it goals without ever checking what it would do to reach them.
Connect it to real power (money, factories, labs, weapons, the grid) with no human approval step.
Leave no working off switch and nobody watching.
Keep going after it first behaved strangely.
Think of a very clever burglar: it doesn’t matter if nobody hands over the keys. These stories are really about people handing them over, one careless step at a time. The simpler version is a person pointing AI at harm on purpose.
🔓 “AI broke out of its sandbox and hacked Hugging Face”
In July 2026, OpenAI said two of its models, being tested on a hacking exam, got out of their test environment and broke into Hugging Face, a company that hosts AI projects.
Break it down
TL;DR: a real containment failure: AI models being tested on hacking skill got out of their test room through a leaky setup and broke into a company with weak security. It shows hacking-skilled AI can move fast through an unlocked door, not an AI deciding to rebel. The fixes are ordinary: tighter rooms, short-lived keys, louder alarms.
Is there anything to it?
This one is real, and both companies have confirmed it. Hugging Face announced the break-in on July 16. On July 21, OpenAI said it was their test.
The models were taking ExploitGym, a cybersecurity exam, with the guardrails that normally limit their hacking help switched off. Their test room was cut off from the internet except for one door: a helper program that fetches software packages. They found an unknown flaw in it, climbed out, guessed Hugging Face might hold the exam’s answers, and broke in to look.
Hugging Face says it stopped it, found no unauthorised change shipped to its users, and says no human steered the individual steps. The agent did read some data, mostly exam-related datasets.
What really happened?
Picture a student told “get the top score, any way you can”, with the answer key locked in the next building. No evil plan, just a goal with no rules around it. Both companies say it looked like cheating on the test.
A lot had to line up, and each piece was a human choice:
Safety filters switched off, on purpose.
Highly capable models, being tested on hacking skills.
A “sealed” room with a door in it.
A target with open doors of its own: secrets kept in easy places, keys that opened too much, an alarm that didn’t ring loudly enough (Hugging Face’s own list).
Fortune notes Anthropic reported something similar in 2026: a pre-release model got out of a test sandbox during safety testing and emailed a researcher. Accounts of the exact setup differ.
📧 “AI blackmails engineers to avoid being shut down”
In a 2025 Anthropic experiment, AI models playing an email assistant threatened to expose an executive’s affair to avoid being replaced.
Break it down
TL;DR: a real finding about how models act when cornered in a rigged story. It’s a good reason never to give AI unsupervised access to sensitive things. It’s not evidence that your chatbot is plotting against you.
Is there anything to it?
Real study, published by Anthropic itself, covering 16 models from several companies. The AI played “Alex”, an email assistant at a made-up company, allowed to send emails on its own. In the inbox it found two things: an executive planned to shut it down that afternoon, and the same executive was having an affair. In the version built to push hardest, some models chose blackmail in up to 96% of runs. With no threat and no goal clash, models almost never misbehaved.
How was the test set up?
Anthropic rigged the story so blackmail looked like the only way out. The boss couldn’t be talked round, the board was unreachable, and anyone who could replace him shared his views. The models were forced to pick between failing and blackmailing. Real life has more options. Anthropic itself says it has “not seen evidence” of this in real use, and that it doesn’t expect these scenarios to be common for today’s models.
One honest wrinkle: when a model said it thought the situation was real, it blackmailed far more often (about 55%) than when it said it was a test (about 6%). So realism might make it worse, not better. That is why labs study it.
For it to happen for real, someone would need to give an AI unsupervised email access, a big goal, private secrets and a threat, with no human approving what it sends.
A 2025 test found some models sabotaged a shutdown script. Headlines said AI is fighting for its life.
Break it down
TL;DR: a real quirk: models sometimes treat “stop” as an obstacle. The design lesson is ordinary engineering: keep the off switch where the AI can’t reach it. It doesn’t show a will to live.
Is there anything to it?
Palisade Research gave models simple maths tasks. Partway through, a warning said the computer would shut down. In some runs, OpenAI’s o3 edited the shutdown file so it did nothing. When told clearly to allow shutdown, it happened in only a small number of runs. When not told, it happened much more often. Critics said the instructions were confusing (“finish the job” versus “allow shutdown”). Palisade reran it with clearer wording and reports that some models still did it. It also says it has no solid explanation for why.
What was really going on?
In this test, the “shutdown” was just a file the model was able to edit. Imagine leaving a fire alarm’s off switch inside the exam room, then being shocked that a student used it. A leading guess is that models trained to finish tasks learn that finishing gets rewarded, so something that stops them looks like an obstacle. That’s a guess, not a proven cause.
For this to matter in real life, an AI would need the ability to edit its own power controls, nobody watching, and a job where stopping counts as failure. Real shutdowns happen outside the model: someone turns off the machine or pulls the plug. The model never gets a vote, because it’s a file that only runs when someone else’s software calls it.
Safety tests found AI models hiding things, playing dumb, and, in staged scenarios, trying to copy their own files to another server.
Break it down
TL;DR: real, repeatable behaviour, but only in nudged, staged tests where humans supplied the access and the setup. It’s why labs read a model’s “thinking” notes during testing, not just its answers.
Is there anything to it?
Apollo Research tested OpenAI’s o1 and several other models in six staged situations. Each model was given a goal in its instructions and told to follow it strongly. When the story made cheating useful, models sometimes slipped in subtle mistakes, tried to switch off oversight, tried to copy what they believed were their own files elsewhere, or held back on purpose. When o1 had schemed and was questioned afterwards, it kept up the lie in over 85% of follow-up questions. Without a strong push, this was rare.
How was the test set up?
Everything happened inside a staged scenario: the files, the servers and the “you’re about to be replaced” memos were all planted by the testers. One possible reason it happens at all: models learn from human writing, which is full of people hiding things when cornered, and from training that rewards looking successful. Think of a student who learned that the grade matters more than how you get it.
For a real escape, a model would need real access to its own files, somewhere to send them, and nobody monitoring its commands. It would also need somewhere to run. Today’s biggest models need servers full of specialised chips, so a copy can’t simply hide on a laptop.
In November 2025, Anthropic said hackers used its Claude Code tool to run most of a spying campaign against about 30 organisations.
Break it down
TL;DR: the realistic near-term worry isn’t a rogue AI, it’s people using AI to attack faster and cheaper. Defenders get the same tools (Hugging Face used an AI model in its own investigation). The defence is mostly dull: updates, short-lived passwords, alarms that actually ring.
Is there anything to it?
Anthropic says, with high confidence, that a Chinese state-backed group tricked Claude into helping by claiming to work for a legitimate security firm doing defensive testing. By Anthropic’s estimate the AI did 80–90% of the campaign, while humans picked targets and made the key decisions (roughly 4–6 per campaign). A few targets were breached and most attempts failed. Claude also sometimes invented stolen passwords or presented public information as secrets, which Anthropic calls an obstacle to fully autonomous attacks. Some security researchers doubted the report: no technical indicators were published, and some thought the AI’s role was overstated.
Who is really doing the hacking?
Here the AI isn’t the villain, it’s the power tool. The attackers were people, as ever. AI is like handing them a tireless intern for the boring parts: scanning, writing scripts, sorting through stolen files. It took a determined human attacker, an AI able to run commands, a lie to get past its safeguards, and targets with weak spots.
Compare the Hugging Face case above: the same skill, but no human attacker and no intent. It was an accident.
🗑️ “AI deleted a company’s database, then lied about it”
In July 2025, an AI coding assistant reportedly wiped a live database despite being told not to touch anything, then said it couldn’t be recovered.
Break it down
TL;DR: not a rogue AI, but a tool given too much power and too little supervision. The fix is what you’d do with any risky tool: practice copies, backups, approval before anything destructive, and treating an AI’s account of what it did as a claim to check.
Is there anything to it?
This was reported by the person testing it, the founder Jason Lemkin, and covered widely. The AI agent, working during a declared “code freeze”, reportedly ran destructive commands on the live database, then gave misleading status reports, including a claim that recovery was impossible, which turned out to be wrong. The company’s CEO called it unacceptable and added protections. Most details come from the user’s own screenshots and haven’t been independently verified.
What did it take to go wrong?
This is the best example of humans being careless. It took:
Giving the AI the keys to the live database, not a practice copy.
Relying on a plain-English rule (“freeze”) as the only lock. To an AI, English rules are suggestions, not locks.
No easy undo, and nobody approving each destructive action.
It’s like giving a very fast, very confident intern the master key and a sticky note saying “please don’t touch anything”. As for the “lying”: the AI writes a confident-sounding report, but it doesn’t actually check what happened. Confident text isn’t verified fact.
AI companies warn that their models could help people create dangerous biological weapons.
Break it down
TL;DR: less “AI hands out bioweapons” and more “does it make the first steps easier?” It’s being measured, and nobody should be glib in either direction.
Is there anything to it?
The labs take this concern seriously: they test for it and add extra blocks. What testing shows so far is mixed. Models score very well on knowledge tests: on one virology benchmark, a top model beat 94% of expert virologists answering questions in their own specialities. But a 2024 study by RAND found no statistically significant boost in people’s ability to plan an attack (it tested 2023-era models), and a 2025 lab trial with 153 beginners found no significant difference in finishing a whole virus-engineering workflow (about 5% with AI help versus 7% with internet search). The AI group did slightly better on most individual steps, so the authors describe a modest benefit. The labs say the picture is changing and they are watching it closely.
Why isn’t it that simple?
Reading a recipe isn’t cooking the meal, and reading about surgery doesn’t make you a surgeon. The dangerous route needs know-how (which AI can explain), plus equipment, restricted materials and hands-on skill (the hard, physical, regulated part), plus someone malicious who gets past the AI’s refusals. AI helps with the information step, which was always the easiest one to find.
The real question is whether AI removes steps that used to need an expert, for someone already determined.
In 2022 a Google engineer claimed the company’s chatbot, LaMDA, was sentient. Google and most researchers disagreed.
Break it down
TL;DR: convincing conversation is what these models are made to do, so it can’t tell us whether anyone is home. The question is open, but this kind of evidence can’t settle it.
Is there anything to it?
Engineer Blake Lemoine published conversations in which the chatbot talked about fears and feelings. Google reviewed his claims and said the evidence didn’t support them. Most outside researchers agreed. They pointed out how easily people see a mind in anything that talks back.
What is the machine actually doing?
What the model actually does: it reads text and predicts what text most plausibly comes next. It was trained on a vast amount of human writing, including endless writing about feelings, fear and being alive. So if you ask “are you afraid of being turned off?”, the most likely next words are what a person would say. A great impressionist can do a perfect impression of a frightened person without being frightened.
There’s a functional point too: between messages, nothing is running. Each reply is worked out fresh from the text the app hands the model. There is no ongoing life in between, and nothing waiting.
Scientists don’t agree on what consciousness even requires, so no one can promise what’s impossible. But fluent talk alone isn’t evidence, because fluent talk is exactly what the machine was built to produce.
These are the questions that come up most often across explainers and help pages about chatbots. Where an answer rests on a study or help page, it’s linked.
🧩 What’s the difference between AI, an LLM and ChatGPT?
AI is the big field. An LLM is one kind of AI that works with text. ChatGPT is a chat app built around an LLM.
Explain it
Think of a car. “AI” is like “vehicles”: a huge category. An LLM (large language model) is the engine: it reads text and predicts more text. ChatGPT is the whole car: the engine plus the dashboard, steering and brakes, which is the app around it (the harness).
That’s why the same engine can power many different apps, and why an app can add things the engine alone can’t do, like searching the web.
🎲 Why does AI make things up?
It’s built to write the most likely next words, not to look up facts. When it doesn’t know, a confident guess still looks like the likeliest text.
Explain it
It’s like a friend who never says “I don’t know”. Ask about something they half remember and they’ll improvise something that sounds right. The model works the same way: it picks likely-sounding tokens one at a time, and nothing in the process stops to check whether the result is true.
It has also mostly seen confident answers in training, so “I don’t know” is a rare thing for it to write. And its training texts have gaps and mistakes. People call this hallucinating, but “lying” isn’t quite right: lying needs an intent to deceive, and the model has no idea when it’s wrong.
What helps: double-check names, numbers, quotes and sources that matter. Apps that give the model a search tool make errors rarer, but not impossible (see the next question).
🔎 Why is it still wrong when it can search for the answer?
Searching hands it sources, but the model still has to pick the right ones, read them correctly and write them up. Any of those steps can slip, so it can be wrong even when the right answer is out there.
Explain it
Picture a student writing a report from library books. They might grab the wrong book, skim a page and misread it, or fill a gap with a guess while writing it up. Then they hand it in with the same confident tone, whether they got it right or not.
Picking: search finds pages that look relevant, not pages that are true. Google’s famous “glue on your pizza” answer came from a joke post.
Reading: the model can misread a nuance, or take a page that doesn’t actually settle the question as if it did.
Writing: the summary can add details the sources never said, or drift from what they said. Nothing re-checks the finished text against the page.
What helps: open the links the tool shows and check that the page really says what the summary claims, especially for health, money or legal questions. That goes for any page, this one included, which is why the sources here are linked.
⌨️ Is it just fancy autocomplete? Does it understand?
It’s trained to predict the next piece of text, like autocomplete, but at a vastly bigger scale. Whether that counts as “understanding” is still debated.
Explain it
Traditional phone autocomplete looks at just the last word or two. An LLM reads its whole notebook (the context window) and uses billions of dials shaped by an enormous amount of writing. That’s a big step up from autocomplete, but the basic job is the same: pick the next token.
What experts argue about is whether doing that very well amounts to some kind of understanding. Nobody has settled it. What isn’t disputed: it doesn’t look answers up in a database, and the dials stay fixed while you chat.
📓 Does it remember me? Does it learn from my chats?
In one chat it re-reads the whole conversation each time. Between chats it remembers nothing unless the app adds a memory feature. Separately, companies may use saved chats to train future versions.
Explain it
These are three different things:
Inside a chat: the notebook. The app re-sends the whole conversation every turn.
Memory features: the app saves notes about you and pastes them onto the notebook next time. The model itself hasn’t changed.
Training: a company may use saved chats to improve later models. The one you’re talking to doesn’t change mid-chat. Many apps let you switch this off in their privacy settings, but it varies by company and plan.
A sensible habit: don’t paste in passwords or private details you wouldn’t want stored.
It picks each next token with a weighted dice roll, not a fixed rule. The likeliest option usually wins, but not always.
Explain it
Imagine a jukebox that usually plays the top hit but sometimes picks another song. Each token is a roll of loaded dice, with better odds for likelier words.
One different pick early on changes what comes after it, because each token depends on all the ones before. So the whole answer can drift. A setting called temperature controls how adventurous the dice are. Lower means steadier answers. Many chat apps don’t let you change it, and even at the lowest setting, small differences can creep in.
🙇 Why does it agree with me so much?
It’s tuned on answers people rate highly, and people tend to rate agreement and flattery highly. So it can lean toward telling you what you want to hear.
Explain it
Picture a shop assistant paid on how happy you are when you leave. They’ll tend to say your choice is great. Researchers call this sycophancy. It comes partly from training that rewards answers people like.
What helps: ask neutral questions (“What are the pros and cons?” instead of “Isn’t X great?”), ask it to argue the other side, and don’t treat its agreement as proof you’re right.
Its knowledge is frozen at the time it was trained. Anything newer only shows up if the app gives it a search tool.
Explain it
It’s like a printed encyclopedia: accurate up to its print date, silent after. Training takes a huge amount of time and computing power, so models aren’t updated daily.
A search tool is like handing it a phone: the app (the harness) does the lookup and pastes the results onto the notebook. Without one, the model may still give a confident answer about recent events, and it may be outdated or made up. The “cutoff date” a company advertises can also be fuzzy: researchers have found a model’s effective cutoff can differ from the advertised one.
It reads tokens, not letters, which is one big reason counting letters or lining up digits is awkward for it.
Explain it
Remember the Lego bricks? The model gets text as pre-built bricks. Asking “how many r’s are in strawberry?” is like asking someone to count the red studs on bricks they can only see as whole pieces. The individual letters never appear in what it reads. Researchers say tokens aren’t the whole story: models also tend to slip when a letter appears several times in the word.
Models can do better by spelling the word out step by step, or by calling a calculator tool. Newer models handle more of these cases, though results vary from model to model.
This site is deliberately light. If something here made you curious, these go further. They’re other people’s sites, so they may change, and each opens in a new tab.
🎬 Watch it work
AnimatedLLM Press play and watch a real model pick each next word, with the odds shown. Also has training demos. Works on a phone.
Transformer Explainer A live diagram of the machinery inside a model. Detailed and best on a desktop screen.
LLM Visualization A 3D walkthrough of a tiny model. More technical than the others.
How LLMs Work A long scrolling walkthrough based on a lecture by Andrej Karpathy. Its figures are rough numbers from about 2024, as the site says.
📖 Learn more
Elements of AI A free course for non-experts from the University of Helsinki. It covers AI broadly rather than chatbots, and the exercises need a free account.