New research highlights a major security flaw in using AI for password creation. In a recent experiment reported by The Register, researchers asked Anthropic’s Claude Opus to generate 50 different 16-character passwords. The results revealed significant vulnerabilities.
Key Risks of AI-Generated Passwords
- High Duplication Rates: Out of 50 requests, only 30 combinations were unique. There were 20 duplicates, including 18 identical sequences.
- Low Entropy: The unpredictability (entropy) of these passwords ranged from 20 to 27 bits. For comparison, a truly random 16-character password should provide between 98 and 120 bits of entropy.
- Predictability: Because AI models aim for patterns, the strings they produce are far easier for hackers to crack using brute-force attacks compared to genuine random generators.
The Verdict
AI models are designed to be helpful and conversational, not statistically random. To secure your accounts, use a dedicated password manager or a cryptographically secure random number generator instead of an AI chatbot.
