Starting AI security: what I know, what I don't

I have always liked the terminal.

I like writing commands, inspecting processes, logs, and network activity, and trying to understand what a system is actually doing.

On the other hand, full-stack development has never really appealed to me. Honestly, I find it a little tedious. Moving components around, fixing CSS, or figuring out why a button sits two pixels out of place does not excite me.

Hacking, however, has always sparked my curiosity.

Not in the cinematic sense of “hacking something”, but because of the mindset behind it: looking at a system and, instead of asking only:

“How does it work?”

asking:

“How can I make it behave in a way its creator never intended?”

For a long time this was just a thought in the back of my mind.

My friend Fanis helped me greatly with this. Through our conversations, I started taking security more seriously and began to understand how different an attacker’s mindset is from that of an engineer who is simply trying to make a system work.

Somewhere along the way, I became interested in the point where security intersects with what I already know:

AI and offensive security.

I know much more about how to build AI systems than how to attack them. I have worked with LLMs, retrieval systems, agents, APIs, multimodal pipelines, and production architectures. In offensive security, however, I am still a beginner.

I want to say that clearly.

I am not trying to add yet another “AI security” label to my résumé. I genuinely want to learn.

Prompt injection, jailbreaks, adversarial examples, data poisoning, model extraction, and tool abuse are some of the areas that interest me. I also know, however, that before I can engage with them meaningfully, I need a stronger grasp of the fundamentals: networking, web security, Linux, protocols, and the broader mindset of offensive security.

There is one idea, though, that already feels useful.

As engineers we mostly learn to ask:

“How can I make this system work?”

Offensive security forces you to add a second question:

“How could someone make it fail?”

As AI systems gain more tools, permissions, autonomy, and access to real-world infrastructure, I believe that second question will only become more important.

I do not yet know where this curiosity will take me.

That is precisely why I want to start pursuing it.