The quest for a truly secure password can feel like an impossible challenge. Many, seeking a shortcut, have turned to artificial intelligence – chatbots like ChatGPT and Gemini – hoping these tools can generate uncrackable codes. But a recent warning from security experts suggests this reliance could be a dangerous mistake.
Tests conducted by security firm Irregular revealed a startling truth: passwords created by AI are surprisingly easy to crack. Despite appearing complex, these AI-generated passwords harbor a fundamental flaw, making them vulnerable to even basic attacks.
The core of the problem lies in how these AI models function. Built on probabilities, they don’t generate randomness; they predict what a secure password *should* look like, based on existing data. This means they’re formulating passwords based on what has been “probably secure” in the past, rather than creating truly unpredictable sequences.
The experts discovered predictable patterns within the AI-generated passwords. They consistently began with uppercase letters, with the letter 'G' appearing with alarming frequency. Certain characters – L, 9, m, 2, $, and # – were ubiquitous, while others were entirely avoided.
Further analysis revealed a striking lack of true randomness. None of the passwords contained duplicate characters, a statistical impossibility with genuine randomization. The AI seemed to believe duplicates would make the password look “less random.” In fact, many passwords were repeated, reducing the number of unique codes generated.
The most common password, G7$kL9#mQ2&xP4!w, appeared a staggering 18 times. This lack of variation highlights the inherent weakness of relying on AI for security. These passwords aren’t strong enough to withstand even a simple brute-force attack.
The consequences of this vulnerability are already manifesting in the real world. Researchers found these same predictable patterns appearing in open-source code on platforms like GitHub, suggesting developers are already unknowingly incorporating these weak passwords into their projects.
This poses a significant security risk, allowing hackers to launch targeted attacks exploiting these recognizable patterns. The danger extends beyond developers to everyday users who trust AI chatbots to safeguard their accounts.
Some AI chatbots, like Gemini, now display warnings advising against using AI-generated passwords, acknowledging the inherent risks and the fact that these passwords are processed on external servers. The message is clear: placing blind faith in AI for security is a gamble you shouldn’t take.
True security comes from genuine, randomized password generation. Password managers often include robust password generators, offering a far more reliable solution. These tools create truly unpredictable codes, safeguarding your accounts from potential breaches.
