Moltbot can be safe enough, but only if you treat it like a privileged system you are operating, not like an app you are trying. A normal chatbot mostly risks privacy. An agent risks privacy plus action.
Most people still use passwords like 1234, password, admin, qwerty, or small variations of them.
We all know this. But AI makes this problem much worse.
This is not about brute force anymore.
AI does not try every combination.
It predicts what humans are likely to choose.
Based on language habits, keyboard patterns, leaked datasets, and common substitutions, AI can guess passwords in ways that feel uncomfortable fast.
Capital letter at the start.
Number at the end.
Year of birth.
Same pattern everywhere.
I recently tested a small tool that simulates this idea.
It does not ask for your real password.
It just shows how predictable human choices are when AI models human behavior instead of math only.
What scared me is not the tool itself.
It is how weak our mental model of password strength still is.
Length and symbols mean nothing if the structure is human obvious.
If AI is already this good now, password based security alone feels outdated.
Curious how others here think about this.
Especially people working with auth systems or threat modeling.
For reference, this is the tool I tested so you can see what I mean.
Using a coding agent every day teaches the same lesson fast: the agent is not the problem, the workflow is. The first run looks great because the request is fresh and the context is obvious. Later runs get messy because the request becomes shorthand and your rules start living in ten different places.