Password Security in the Age of AI

In the age of artificial intelligence, access controls are increasingly important as AI can accelerate the discovery and misuse of compromised credentials.

In 2023, Hugging Face reported that a malicious user had taken control of organizations belonging to Meta/Facebook and Intel on its platform using employee passwords that had been reused and compromised in an unrelated breach.

In July, Hugging Face experienced another intrusion, this time with a science fiction-sounding twist: AI agents powered by OpenAI models autonomously bypassed isolation controls during internal cybersecurity evaluations and compromised parts of Hugging Face’s production infrastructure.

The reported intrusion did not depend on cracking strong passwords or breaking encryption. Instead, an AI agent found 14 publicly exposed Hugging Face access tokens, verified that they provided write access and shared them with other agents through an improvised message board. The agents used the exposed credentials and exploited weaknesses in Hugging Face’s systems to gain access to additional systems and data.

These incidents underscore the continued importance of password security as AI accelerates the exploitation of compromised credentials and weaknesses in access controls. For organizations, this makes effective governance of credentials and access permissions increasingly important.

Strong Passwords Remain Essential

Password best practices still apply. Passwords should be unique and difficult to predict. Guidance from the National Institute of Standards and Technology recommends passwords of at least 15 characters when a password is the sole authentication factor and for screening proposed passwords against commonly used, expected or compromised passwords. Password managers can help users maintain unique passwords across accounts.

Further, research has found that passwords generated directly by large language models should not be used to create passwords as they can contain predictable patterns, even when they outwardly appear complex. Rather, organizations should utilize password generators that use cryptographically secure randomness. Because passwords can be phished or exposed, organizations should use multifactor authentication, prioritizing phishing-resistant methods such as passkeys that require a PIN or biometric verification.

Access Control for People and Agents 

As organizations adopt AI tools and processes, their governance programs should address how employees and automated systems access company systems and data. A written password policy should be part of this broader access-control program. NIST’s Cybersecurity Framework regards cybersecurity governance as an enterprise responsibility while its Artificial Intelligence Risk Management Framework emphasizes governance throughout the AI lifecycle. Organizations can use those frameworks to clarify decision-making responsibility, document risk acceptance and verify whether written policies match deployed controls.

An AI agent may access email, code, cloud systems, or personnel and customer records. Allowing it to use an employee’s credentials without controls that distinguish the agent’s actions from the employee’s can make it difficult to determine who took an action and may give the agent more access than it needs. Organizations should identify agents and their owners, approve their tasks and connections, restrict permissions to the approved work, log actions and promptly revoke access when no longer needed.

As an organization’s AI use evolves, the credentials available to AI agents and the access those credentials provide should be reviewed. AI and cybersecurity governance policies should identify who approves that access, who determines whether access remains necessary, and who is responsible for revoking access when no longer needed or when a credential is exposed or misused.

Legal Requirements and Potential Liability

Some password and access controls are legal requirements for regulated entities. Subject to applicable exemptions, New York’s Department of Financial Services Cybersecurity Regulation requires covered entities to limit access privileges, review them at least annually, remove unnecessary access and maintain a written password policy that meets industry standards if passwords are used. The Federal Trade Commission Safeguards Rule requires covered financial institutions to implement access controls. It also requires MFA for individuals accessing covered information systems unless the individual responsible for overseeing and implementing the information security program approves reasonably equivalent or more secure access controls in writing.

Compromised credentials can also lead to security incidents that trigger notification obligations, regulatory investigations, litigation and breach-of-contract claims. Following an incident, regulators and other parties may scrutinize whether password and access controls were appropriate, consistently implemented, and aligned with the organization’s written policies and contractual commitments.

Cybersecurity and AI Governance 

The Hugging Face incidents illustrate how familiar credential risks can be exacerbated when AI accelerates their exploitation. Password and credential security are shared concerns for cybersecurity and AI governance. Organizations should align password, access-control, vendor, AI-use and incident response policies with actual practices. Strong passwords remain essential, along with clear accountability for protecting credentials and limiting the access they provide.

_____

About Amanda and Claire

Amanda Novak, CIPP/US, CIPP/E, AIGP, FIP, is a senior counsel at law firm Constangy, Brooks, Smith & Prophete and co-chair of the firm’s Artificial Intelligence practice group. She advises clients on compliance with data privacy and information security laws and regulations and helps organizations navigate the rapidly evolving legal, regulatory and governance issues surrounding the development, deployment and use of artificial intelligence. Amanda can be reached at anovak@constangy.com.

Claire Bowen, an associate at Constangy, Brooks, Smith & Prophete, counsels clients on compliance with data privacy and information security laws and guides them through developing policies and practices to meet their regulatory and contractual obligations. She can be reached at cbowen@constangy.com.