How AI Actually Works: Claude, ChatGPT and LLMs Explained Simply

Your text gets split into tokens. A token is a small piece of text, not always a full word. "Hello world" might become ["Hello", " world"]. Longer or unusual words often get broken into smaller parts.

Try it yourself:

Each token then gets turned into numbers. In AI, those numbers are often called a vector or an embedding. Think of that as the model's internal way of storing meaning so related words and ideas end up closer together.

Attention is the part that helps the model decide what matters most in a sentence. Each token checks the other tokens around it to figure out which words are important for meaning.

When the model reads "The cat sat on the mat", the word "sat" is linked closely to "cat" and "mat" because those words help explain who did the action and where it happened.

Large models do this many times in parallel using attention heads. An attention head is just one small pattern detector focused on a certain kind of relationship:

• →One head may track who did the action
• →Another may track what the action applies to
• →Another may connect names, pronouns, and references
• →Many others learn patterns around order, grammar, tone, and structure

The last step is prediction. The model scores many possible next tokens and picks one. Those scores are called probabilities, which just means how likely each option is.

After it picks the next token, that token gets added to the running answer. Then the model does the same thing again. That loop is why replies appear word by word even though a lot of math is happening underneath.

When you ask AI to build software, it does not just guess. It considers options, checks its tools, thinks through the logic step-by-step, and then brings the app to life.

Total cost per 1000 requests: $5-50 depending on model choice, tools used, and complexity. This is why ChatGPT Plus ($20/month) and Claude Pro ($20/month) exist - subscriptions assume 500-2000 requests/month. Heavy users cost more than subscription revenue. Light users subsidize them.

How the system keeps its place

These systems need to remember where they were. Teams save the current state, which means the conversation, tool results, and next step, in a database. If the process stops or times out, it can restart from the last saved point instead of beginning again.

Where a person still has to approve

For important actions, a human still needs to sign off. The agent prepares the action, pauses, and waits for approval. This is common for money movement, risky customer messages, deletions, or policy exceptions.

Safety rules around tools

Not every tool is safe to let loose automatically. Real systems put clear limits around what the agent can do:

• →Rate limits per tool (max 10 DB queries per workflow)
• →Permission checks (agent can read orders, not delete them)
• →Cost limits (max $5 in API calls per workflow)
• →Audit logs (every tool call logged with timestamp, inputs, outputs)

How teams watch what the agent is doing

If you cannot see what the agent is doing, you cannot trust it. Teams track simple things like success rate, number of steps, common failures, and cost:

Tracing tools follow each workflow from start to finish. Dashboards show slow steps, repeated loops, and failures so teams can fix the system before it causes trouble.

Common software used to build these systems

A vocabulary is the complete set of units a model can recognize and produce. How you define those units involves a hard tradeoff with no perfect answer.

BPE is a bottom-up compression algorithm adapted for vocabulary construction. The loop is simple in principle:

The result: common strings like function or return get a single token. Rare words get decomposed into pieces, often slicing right through what a linguist would call morpheme boundaries. That is intentional: BPE optimizes for corpus frequency, not linguistic structure, and those two things do not align.

If you have spent time prompting models at scale, you have probably run into behaviors that trace back to the tokenization layer rather than the model weights.

Each token ID maps to a learned embedding vector. That vector is not engineered by hand. It starts random and gets updated continuously during training as the model learns to predict the next token across trillions of examples. By the end of training, the embedding for a given token implicitly encodes everything the model observed that token doing across the corpus.

This raises a real question: does the embedding for a token like deploy "know" it is spelled d-e-p-l-o-y? Formally, no. The token is just an integer. But research shows character-level information does bleed into embeddings. The most likely reason: the same root word surfaces in many tokenized forms across a large corpus (singular, plural, past tense, mid-sentence, sentence-initial, after punctuation, inside a code block) and the model is incentivized to build representations that generalize across those surface variations.

Practical implication: models handle spelling and character-level tasks better for common words (which appear in many tokenized surface forms during training) and worse for rare words or niche proper nouns that were almost always tokenized the same way. If you are building a prompt that requires character-level precision, explicitly spell out the string in your prompt rather than assuming the model can decompose it cleanly.

Before a model ever reaches you, it goes through a process called alignment training. This is where the model is trained not just on what is factually correct but on what is helpful, harmless, and honest.

The most common technique is called RLHF (Reinforcement Learning from Human Feedback). Human reviewers rate thousands of model responses. The model is then updated to produce more of the good responses and fewer of the bad ones. Over many rounds, this shapes the model's behavior before anyone outside the lab sees it.

• →The model learns to decline requests that could cause harm
• →It learns to flag uncertainty instead of making things up confidently
• →It learns to avoid helping with things that are clearly illegal or dangerous
• →It learns tone, nuance, and when to push back on a bad idea

This is not perfect. Models can still be pushed in wrong directions with the right prompts. But the baseline behavior is trained, not bolted on as an afterthought.

Every serious AI product runs on top of a system prompt. Before the model sees your message, the company or developer who built the product has already given the model instructions: what it can talk about, what it should refuse, what persona it should use, and what safety rules to follow.

Think of it as the employer giving new rules to a contractor. The model follows them. So even if the underlying model could technically answer something, the system prompt can block it entirely.

On top of that, most platforms run content filters that check both input and output:

• →Input filters catch known harmful patterns before they reach the model
• →Output filters check the model's response before it reaches you and block or rewrite anything that crosses a line
• →Rate limits and monitoring flag unusual usage patterns and slow down or stop automated abuse

The model by itself cannot do anything. It reads text and writes text. That is the whole thing. It cannot reach out to the internet, execute code, send emails, move money, or control systems unless a tool is explicitly connected and the system running it allows it.

When a model does have tools, those tools are scoped. A customer support agent with access to your order data does not also have access to your bank account. The access is defined by whoever built the product, not decided by the model.

This is important because it means the risk surface is well-defined. An agent that can only read your calendar and draft meeting summaries is limited to exactly those two things. The worry about "the AI doing something unexpected" is really a question about whoever wired it up and what permissions they granted.

Before any major model ships, the company runs red team exercises. Red teaming is where a group of people try as hard as they can to break the model: get it to say something harmful, bypass its safety rules, produce dangerous content, or behave in an unexpected way.

What they find gets fixed before release. What slips through gets patched after. This is not so different from how security teams test software. You ship, you monitor, you patch, you repeat.

Anthropic (who makes Claude), OpenAI (ChatGPT), Google (Gemini), and Meta (Llama) all publish safety reports and run external third-party audits. This does not mean the models are perfect. It means there is a process, it is improving, and problems are documented publicly.