Don't let an AI chatbot pick your password, ever

Research cited by ZDNET finds AI chatbots (Claude, ChatGPT, Gemini) generate password “randomness” that’s weak: in 50 tests, only ~30 unique passwords were produced and one password repeated with a 36% probability. The article argues that AI outputs show predictable patterns (e.g., commonly starting with a letter and often following with the number 7) and should not be relied on for account security, recommending cryptographically secure password generators or password managers instead.

Analysis

This is a trust/UI issue, not a direct earnings issue. The incremental P&L impact on GOOGL and MSFT is near-zero today, but the second-order risk is that “AI as a security helper” becomes harder to market if low-stakes tasks are visibly brittle. That matters more for consumer-facing assistant brands than for core cloud revenue: GOOGL is more exposed on reputation, while MSFT’s enterprise security stack is better insulated and can even absorb some credibility from the push toward passkeys and managed credentials.

The real beneficiaries are identity and password-management workflows, not the large-cap platforms. If users and IT teams internalize that probabilistic models are bad at deterministic randomness, that supports adoption of password managers, passkeys, and managed identity tooling over the next 6-18 months. In the near term, there is little reason for multiple compression on MSFT, but any repeated headlines about “AI security” errors can cap enthusiasm for agentic features and slow consumer uptake.

Contrarian view: the market may overread this as an AI indictment when it is mostly a prompt-quality and use-case-selection problem. The article’s signal is strongest only if the companies push assistants into credential handling or security advice; absent that, the practical financial impact is limited. What would falsify the negative read is sustained enterprise traction in passkey/authentication products or no measurable brand hit in consumer trust metrics after subsequent security coverage.

Key Decisions for Investors

• No outright short on GOOGL/MSFT from this alone; treat as a watch item unless there is evidence of product-level security missteps or brand damage in follow-up coverage.
• If the market starts pricing a broader AI-trust backlash, consider a small relative trade: long MSFT / short GOOGL over 1-3 months, on the view that MSFT’s security positioning is more enterprise-anchored while GOOGL’s consumer assistant brand is more vulnerable.
• Use any headline-driven dip to add tactically to MSFT only if management commentary continues to emphasize Entra, Authenticator, or passkey adoption; that would convert the narrative into a modest security-suite tailwind.
• For a tactical hedge, pair long CIBR or HACK against short QQQ for 1-2 weeks if more AI-security headlines emerge, as the market may temporarily rotate into identity/security software.
• Set an alert for any quantified evidence of consumer behavior change—passkey adoption, password-manager downloads, or security incident rates; absent that data, do not force a thematic trade.