Loading story…
Testing by AI security firm Irregular found that passwords generated by popular LLMs (including ChatGPT, Claude, and Google Gemini) are often highly patterned and non-random, making them more guessable than they appear and potentially useful additions to attacker wordlists for dictionary and targeted brute-force attacks. In repeated prompting experiments, Irregular observed substantial duplication and structural consistency (e.g., repeated prefixes/suffixes and other recurring formats), indicating the outputs are driven by token-prediction behavior rather than uniform randomness; this can mislead users because the strings may look complex and can score “strong” in common password-strength checkers that don’t account for LLM-specific generation patterns.
The reporting emphasized that defenders should avoid using LLMs as password generators and instead rely on password managers and OS-backed cryptographic random number generators that incorporate real entropy to produce unpredictable passwords. Separate commentary also argued for stronger authentication posture overall—prioritizing phishing-resistant MFA and longer, truly random passwords or passphrases when passwords must be used—while noting that many real-world credential compromises stem from theft (social engineering, malware, or exploitation) rather than pure guessing, making MFA and secure credential handling critical alongside password complexity guidance.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting emphasized that AI coding assistants and agentic development tools could introduce weak LLM-generated passwords into code or production environments, and that recognizable password patterns may aid future brute-force or dictionary attacks. Coverage also recommended replacing any AI-generated passwords, enabling MFA, and using passkeys or secure password managers instead.
Irregular publicly released its findings in "Vibe Password Generation: Predictable by Design," warning that LLM-generated passwords are inherently predictable because the models optimize for plausible text rather than cryptographic randomness. The report said prompting and temperature changes do not solve the issue and advised rotating any AI-generated credentials and using password managers or cryptographically secure generators instead.
Irregular tested major generative AI systems including Claude, GPT-5.2/ChatGPT, and Gemini by prompting them to create strong 16-character passwords. The researchers found repeated outputs, common structural patterns, and substantially reduced effective entropy compared with truly random passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalwarebytes.com
Open sourceirregular.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent analysis of over two billion leaked passwords revealed that easily guessable and weak passwords such as `123456`, `admin`, and `password` remain among the most commonly used worldwide. Variations like `Aa123456`, `Aa@123456`, and sequential keyboard patterns such as `qwerty` and `1q2w3e4r` also feature prominently in the top 100, highlighting persistent poor password hygiene among users. The study found that a quarter of the most common passwords consist solely of numbers, and 38% contain the string `123`, making them highly susceptible to brute-force and guessing attacks. Complementing these findings, research into the top 1,000 most-visited websites showed that 42% have no minimum password length requirements, and only five enforce strong password policies that include length, special characters, and case sensitivity. Additionally, 11% of these sites have no password creation requirements at all, and only 2% support passkeys as a secure alternative. The lack of robust password enforcement on major websites, especially in sectors like government and healthcare, perpetuates the use of weak passwords and increases the risk of account compromise.
Jun 29, 2026
Recent research highlights the persistent risk posed by weak passwords, with modern password cracking tools able to compromise a significant portion of real-world credentials in under an hour. Analysis of over 190 million passwords reveals that nearly 60% can be cracked within sixty minutes, largely due to the power of contemporary GPUs and advanced brute-force and dictionary attack techniques. Security experts emphasize the importance of adopting stronger authentication strategies, such as using passphrases and password managers, to mitigate these risks and prevent unauthorized access to sensitive systems and data. Longitudinal studies of leaked password datasets from 2007 to 2025 show that user habits and password strength have improved over time, particularly following major breach events and the introduction of stricter password policies. The adoption of machine-generated passwords and built-in password managers in operating systems has contributed to measurable progress, though a minority of users still rely on weak, easily guessed credentials. Security professionals recommend continued education and the implementation of advanced password management tools to address remaining gaps and further strengthen enterprise security posture.
Jun 29, 2026
Security researchers highlighted multiple ways **LLM adoption can introduce or amplify risk**, including both technical attacks and unsafe development practices. G DATA reported that a Git-hosted “detector” for the **Shai-Hulud worm** shipped with “test files” that were effectively *real malware*: scripts capable of deleting user directories and, in at least one case, uploading data to actual threat actors. The files were apparently intended to validate detection efficacy and may have been produced via AI-assisted “vibe coding,” where the model replicated malicious behavior one-to-one while comments claimed the code was only a simulation; although the test artifacts are not executed during normal tool operation, users could trigger damage by manually running them. Separate academic work summarized by Bruce Schneier described **side-channel attacks against LLM inference**, where data-dependent timing and token/packet-size patterns (including those introduced by efficiency techniques like speculative decoding) can leak information about user prompts even over encrypted channels. Reported impacts include inferring conversation topics with high accuracy and, in some settings, recovering sensitive data such as phone numbers or credit card numbers via active probing. In parallel, an SC Media segment discussed the operational upside of **LLM-driven secure code analysis**, citing results that improved security across hundreds of open-source projects but noting the importance of human validation and patching effort; an OSINT Team post provided a cautionary, practitioner-level example of how easily malware can be accidentally executed during analysis, reinforcing the need for disciplined handling and isolation when working with suspicious files.
Jun 29, 2026