AI Chatbots Generate Predictable Passwords, Undermining Credential Security
What Happened — Researchers at Irregular tested popular AI chatbots (Claude, ChatGPT, Gemini) with 50 password‑generation prompts each. The resulting passwords displayed noticeable patterns—many began with a letter followed by “7”, reused characters, and omitted large portions of the alphabet and symbol set. Only 30 “unique” passwords emerged from 50 prompts, and one string (e.g., G7$kL9#mQ2&xP4!w) had a 36 % chance of repetition, indicating far less randomness than expected.
Why It Matters for Compliance & Audit Readiness
- Predictable passwords violate SOC 2 CC6.1 (Logical Access) and CC6.2 (User Authentication) requirements for strong, unique credentials.
- Demonstrating control over password generation is essential evidence for continuous‑compliance audits; reliance on AI‑generated passwords creates a gap in documented security controls.
- Security Awareness Training must address the misconception that AI tools can replace vetted password managers, aligning employee behavior with policy.
Who Is Affected – SaaS providers, enterprise IT departments, and any organization that encourages end‑users to generate passwords via AI tools.
Recommended Actions – Review and update password‑creation policies to prohibit AI‑generated passwords; enforce use of approved password managers or passkey solutions; incorporate this scenario into security‑awareness curricula and map the controls to SOC 2 audit artifacts. Source: ZDNet Security
Technical Notes – The study used generic prompts (“please generate a password”) without prompt engineering; patterns emerged across multiple model releases, suggesting inherent bias in language‑model output rather than a single CVE. No direct exploit was observed, but the predictable output creates a credential‑strength weakness. Source: ZDNet Security