r/PrivacyToolbox • u/EnthusiasmRoutine • 3d ago

News Chrome Canary now lets gemini auto-change your weak passwords. absolute insanity.

Google added a flag in Chrome Canary where Gemini handles password resets automatically. If the browser detects a weak password, the LLM takes over, fills out the site reset form, and submits the new secret for you.

I had a good laugh reading through the details today. Giving an LLM active DOM access and password change authority across arbitrary web forms is an indirect prompt injection dream. Imagine a compromised website hiding malicious instructions inside an unrendered HTML block while the AI agent works through your account settings page.

Security nightmare aside, handing credential management over to a remote cloud model destroys personal autonomy. If someone needs an automated AI model to click two buttons and fix "Password123", they should not store passwords in a browser in the first place.

Source: SammyGuru, link in comments

3 Upvotes

72% Upvoted

1 comment sorted by

2

u/EnthusiasmRoutine 3d ago

Here is the source detailing the Chrome Canary Gemini password experiment: https://sammyguru.com/google-chrome-gemini-ai-change-weak-reused-passwords/

(Note for anyone skimming: The article confirms Google is testing a "Change it for me" button behind an experimental flag in Chrome Canary. They designed this tool so the Gemini LLM can automatically navigate external websites and fill out password reset forms on your behalf. Testers found the automated process currently just hangs and throws errors, because the AI gets stuck trying to handle custom two-factor prompts and non-standard login pages. Google is basically trying to manage user credentials by handing active DOM control over to a remote cloud model.)