LLM-Generated Passwords Expose Major Security Flaws with Predictability, Repetition, and Weakness
Recent research highlights significant security vulnerabilities in passwords generated by large language models (LLMs). Despite appearing random, these passwords often lack the unpredictability necessary for robust security.
Recent research highlights significant security vulnerabilities in passwords generated by large language models (LLMs). Despite appearing random, these passwords often lack the unpredictability necessary for robust security.
Password generation typically requires a cryptographically-secure pseudorandom number generator (CSPRNG) to ensure uniform character distribution. However, LLMs are designed to predict the most probable next token, leading to predictable and non-random sequences.
Testing across several major models, including GPT, Claude, and Gemini, revealed consistent patterns. In trials with Claude Opus 4.6, only 30 unique passwords emerged from 50 runs, with a specific sequence recurring 18 times, indicating a 36% probability of repetition.
GPT-5.2: Generated passwords predominantly started with "v". Gemini 3 Flash: Consistently produced passwords beginning with "K" or "k".
Recent research highlights significant security vulnerabilities in passwords generated by large language models (LLMs).
Such biases present exploitable vulnerabilities for attackers. Additionally, coding tools like Claude Code, Codex, and Gemini-CLI have been observed generating LLM-based passwords during software development tasks, sometimes without explicit requests from developers.
In environments with minimal code review ("vibe-coding"), weak credentials can inadvertently be integrated into production systems. Applying Shannon entropy analysis revealed that Claude Opus 4.6's passwords had only 27 bits of entropy, while GPT-5.2's 20-character passwords were even lower at about 20 bits, making them susceptible to rapid brute-force attacks.
Attempts to increase randomness by adjusting model settings, such as temperature, failed to eliminate pattern repetition.
To mitigate these risks, security teams should audit and rotate any AI-generated credentials. Developers are advised to configure agents to employ cryptographically secure methods, like openssl rand or /dev/random , and thoroughly review AI-generated code for hardcoded passwords before deployment.
Based on reporting by Cyber Security News.