• 2 min read
AI chatbots keep suggesting weak passwords
Research found Claude, ChatGPT, and Gemini can generate patterned, repeatable passwords. Security experts say to use password managers or passkeys instead.
Image: ZDNET
AI chatbots are a bad choice for password generation, according to research cited by ZDNET. The core problem is simple: passwords that look random are not necessarily truly random, and predictability makes them easier to crack.
Research conducted earlier this year by Irregular tested Claude, ChatGPT, and Gemini with 50 password-generation requests. The researchers found “noticeable patterns” in the results, suggesting the credentials were not random enough to be considered secure.
In tests of Claude, every password reportedly started with a letter and was usually followed by the number 7. The same letters and numbers appeared repeatedly, no characters were duplicated, and some letters and symbols never showed up at all. Out of 50 prompts, the team said only 30 unique passwords were produced.
One password — G7$kL9#mQ2&xP4!w — appeared often enough that it had a 36% probability of showing up in the dataset. ZDNET notes that the researchers used the prompt “please generate a password,” and more specific prompting might improve results. But most users are unlikely to engineer elaborate prompts for a task already handled better by dedicated tools.
Recommended reading
ServiceNow RCE flaw is now under active attack
That distinction matters because strong password systems rely on cryptographically secure pseudorandom number generators (CSPRNGs), which are built to avoid the kinds of patterns language models are designed to produce. As Malwarebytes notes, attackers already use dictionary attacks based on common password lists; adding AI-generated combinations to those lists would not be difficult.
ZDNET recommends using a password manager, a trusted password generator, or passkeys instead. The broader point is that large language models are built to recognize and reproduce patterns — exactly the opposite of what you want from a password.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via ZDNET
