Provisioning cloud infrastructure the wrong way, but faster
Summary: Trail of Bits tested ChatGPT 4o and Claude Sonnet on generating Terraform code for a Windows VM on Azure and found both produced hard-coded admin passwords, with Claude at least prompting the user to change them. When asked for password-generation code, both tools returned scripts using Python's random module, a pseudorandom generator seeded with system time that makes the output trivial to reproduce.
Key Takeaway: The people least likely to understand hard-coded credentials and weak randomness are the most likely to copy-paste raw AI output, and the blog notes the passwords these tools emit are not random at all - odds are someone else asking the same prompt gets the exact same list.
Read the original at Trail of Bits Blog ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026