AI language models generate weak passwords despite appearing secure
Security experts at Kaspersky warned that large language models including ChatGPT, Llama, and DeepSeek generate passwords that appear random but are actually weak and vulnerable to cracking. In testing 1,000 passwords from each model, researchers found that 87-88% of passwords from Llama and DeepSeek failed to meet strength standards required to resist cyberattacks, while 33% of ChatGPT passwords failed the test.
What happened
Aleksei Antonov, head of data science at Kaspersky, conducted an experiment generating 1,000 passwords from leading large language models including ChatGPT, Llama, and DeepSeek.
The models consistently omitted special characters or numbers from generated passwords: 26% of ChatGPT passwords, 32% of Llama passwords, and 29% of DeepSeek passwords lacked required special characters or digits, while DeepSeek and Llama sometimes generated passwords shorter than the recommended 12-character minimum.
When tested against a machine learning algorithm developed in 2024 to measure password strength, approximately 60% of AI-generated passwords were vulnerable to cracking within one hour using modern graphics processors or cloud-based cracking tools.
Reported impact
Testing revealed that 88% of DeepSeek-generated passwords and 87% of Llama-generated passwords failed to meet strength standards required to resist sophisticated cyberattacks, while 33% of ChatGPT-generated passwords failed Kaspersky's strength test.
The weak passwords pose security risks to users who rely on AI language models to generate passwords, potentially enabling account compromise across multiple services.
Index analysis
Large language models lack the capacity to generate true randomness and instead imitate patterns from training data, making their output predictable to attackers familiar with how these systems operate.
Passwords generated by AI appear random on the surface but fail to incorporate the mix of uppercase letters, lowercase letters, numbers, and symbols needed to meet security standards.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.