AI-generated passwords carry a learnable tell

Most people pick a password the way a grade-schooler picks a locker combination: jam in the right character classes and hope entropy carries the day. The harder problem is that AI credential generators have the same tell. When a large language model mints a password, it does not sample uniformly across symbols. It samples the next character class from a learned distribution, so every string it produces carries a learnable rhythm across its positions, and a brute-force attacker who knows the rhythm searches the constrained space first.

PCMag's test of Google's Gemini made the cadence visible. A batch of 20-character strings walked the same character-class path, repeating a fixed rhythm of letters, numbers, and symbols end to end. Read it out loud, the way you would read a phone number in chunks, and the supposed randomness is gone.

The cadence is prompt- and model-dependent, not a universal AI flaw. Irregular's "Vibe Password Generation" work argues the failure is structural across coding and agentic models, and Malwarebytes, ZDNet, and Cybersecurity Intelligence flag the same risk in the same window. The honest test for any future string is the rhythm: if you can read the character classes in a pattern, the entropy an attacker has to search has just collapsed.

The fix is not a smarter prompt. It is a different tool: a reputable password manager, or EFF's diceware word list. Both sample from a real random source. Chatbots are readers of text, not generators of it, and that difference is what a brute-force bot exploits first.