Be Alert, Ask ChatGPT And Other AIs To Create Passwords Turns Out To Be Dangerous

JAKARTA - If you are often confused about creating strong passwords, asking artificial intelligence chatbots (AI) to create your password doesn't seem right.

Kaspersky's latest findings suggest that most of the passwords produced by this large language model (LLM) are still vulnerable to cyberattacks.

Head of the Science Team Lead Team at Kaspersky, Alexey Antonov, tested this by making 1,000 passwords using several more prominent and trusted NGOs including ChatGPT (from OpenAI), Llama (from Meta), DeepSeek (from China).

All models are aware that good passwords consist of at least 12 characters, including big and small letters, numbers, and symbols. They reported this when creating passwords," said Antonov.

Based on the trial, Antonov found that DeepSek and Llama sometimes produce passwords consisting of dictionary words, in which there are the same letters, symbols, and numbers combined, such as: (DeepSee) S@d0w12, M@n@go3, B@n@7, and K5yB0a8dS8, S1mP1el1on (Llama).

On the other hand, ChatGPT does not experience this problem and generates random-looking passwords. For example: qLux@^9Wp#YZ, LU#@^9WpYqxZ, or YLU@x#Wp9q^Z.

From these findings, 88% of the passwords from DeepSek and 87% of the Llama are not strong enough to withstand the brute force attacks from advanced hackers. Meanwhile, ChatGPT showed better results, but still recorded 33% of passwords that failed to pass Kaspersky's security tests.

The problem is that LLMs don't create real randomness. Instead, they imitate the pattern of existing data, making the results predictable by attackers who understand how this model works," Antonov noted.

Instead of using AI, Antonov recommends the use of a dedicated password manager, which uses cryptographically secure random generators and stores credentials in a digital safe that is protected by one main password.

Some password managers also provide autofilling and synchronization across devices, simplifying processes, including monitoring of violations, notifying users if their credentials appear in data leakage.